diff options
| author | VijayaKumar T M <vtmuni@codeaurora.org> | 2019-11-12 11:57:10 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2020-02-10 00:04:22 -0800 |
| commit | 802825162ae7134a8db8973a3a1ac63d6c54dc25 (patch) | |
| tree | 12ae3694e7db183a394a5a2f0835604845ff8e9a | |
| parent | f1a61bc4b50922e542f3af2d0325198268520884 (diff) | |
msm: camera: Fix OOB issue in IR CUT driver
If user passes an aribitary command with _IOC_DIR(cmd) == _IOC_NONE,
"arg" should point to any arbitrary address.
Check for invalid command and return error.
CRs-Fixed: 2299560
Change-Id: Ic48c9526b914f97bfa76fda2d0b612e832cf91e9
Signed-off-by: VijayaKumar T M <vtmuni@codeaurora.org>
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/sensor/ir_cut/msm_ir_cut.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/platform/msm/camera_v2/sensor/ir_cut/msm_ir_cut.c b/drivers/media/platform/msm/camera_v2/sensor/ir_cut/msm_ir_cut.c index a0e35ba99a25..2516914e4b53 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/ir_cut/msm_ir_cut.c +++ b/drivers/media/platform/msm/camera_v2/sensor/ir_cut/msm_ir_cut.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2016, 2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -499,7 +499,6 @@ static long msm_ir_cut_subdev_do_ioctl( struct msm_ir_cut_cfg_data_t ir_cut_data; CDBG("Enter"); - ir_cut_data.cfg_type = u32->cfg_type; switch (cmd) { case VIDIOC_MSM_IR_CUT_CFG32: @@ -509,6 +508,7 @@ static long msm_ir_cut_subdev_do_ioctl( return msm_ir_cut_subdev_ioctl(sd, cmd, arg); } + ir_cut_data.cfg_type = u32->cfg_type; rc = msm_ir_cut_subdev_ioctl(sd, cmd, &ir_cut_data); CDBG("Exit"); |