diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-01-09 01:32:01 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-01-09 01:32:01 -0800 |
| commit | 2113b4e7d269eca0f09587f0131dadf7cb580bcb (patch) | |
| tree | b5b57374eb3bcb288670732eeaefde8eb636f528 | |
| parent | e863daf4136980e0506cbbd8a037deecc24127fe (diff) | |
| parent | bc6face6b2294268877e74f60b45b0b76dcd0339 (diff) | |
Merge "msm: camera-v2: vpe: Add check to prevent index out of bounds"
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c | 19 | ||||
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.h | 3 |
2 files changed, 17 insertions, 5 deletions
diff --git a/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c b/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c index f2f1dca81f18..d7fb2449582c 100644 --- a/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c +++ b/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015 The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2016 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1054,10 +1054,16 @@ static int vpe_reset(struct vpe_device *vpe_dev) return rc; } -static void vpe_update_scale_coef(struct vpe_device *vpe_dev, uint32_t *p) +static int vpe_update_scale_coef(struct vpe_device *vpe_dev, uint32_t *p) { uint32_t i, offset; offset = *p; + + if (offset > VPE_SCALE_COEFF_MAX_N-VPE_SCALE_COEFF_NUM) { + pr_err("%s: invalid offset %d passed in", __func__, offset); + return -EINVAL; + } + for (i = offset; i < (VPE_SCALE_COEFF_NUM + offset); i++) { VPE_DBG("Setting scale table %d\n", i); msm_camera_io_w(*(++p), @@ -1065,6 +1071,8 @@ static void vpe_update_scale_coef(struct vpe_device *vpe_dev, uint32_t *p) msm_camera_io_w(*(++p), vpe_dev->base + VPE_SCALE_COEFF_MSBn(i)); } + + return 0; } static void vpe_input_plane_config(struct vpe_device *vpe_dev, uint32_t *p) @@ -1102,13 +1110,16 @@ static void vpe_operation_config(struct vpe_device *vpe_dev, uint32_t *p) */ static void msm_vpe_transaction_setup(struct vpe_device *vpe_dev, void *data) { - int i; + int i, rc = 0; void *iter = data; vpe_mem_dump("vpe_transaction", data, VPE_TRANSACTION_SETUP_CONFIG_LEN); for (i = 0; i < VPE_NUM_SCALER_TABLES; ++i) { - vpe_update_scale_coef(vpe_dev, (uint32_t *)iter); + rc = vpe_update_scale_coef(vpe_dev, (uint32_t *)iter); + if (rc != 0) + return; + iter += VPE_SCALER_CONFIG_LEN; } vpe_input_plane_config(vpe_dev, (uint32_t *)iter); diff --git a/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.h b/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.h index f1869a2b9776..0c55ff70309e 100644 --- a/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.h +++ b/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.h @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -70,6 +70,7 @@ #define VPE_SCALE_COEFF_LSBn(n) (0x50400 + 8 * (n)) #define VPE_SCALE_COEFF_MSBn(n) (0x50404 + 8 * (n)) #define VPE_SCALE_COEFF_NUM 32 +#define VPE_SCALE_COEFF_MAX_N 127 /*********** end of register offset ********************/ |