From 0c7eaae62abb514196863cc596090ca23ef80612 Mon Sep 17 00:00:00 2001 From: Krishnankutty Kolathappilly Date: Wed, 16 Nov 2016 18:22:58 -0800 Subject: msm: cpp: Fix for buffer overflow in cpp. Fix for buffer overflow while handling ioctl. Instead of checking for length boundary, fix checks for exact length. CRs-Fixed: 518731 Change-Id: I9002f84b219e8b06ae0672d87c2d999e728a75aa Signed-off-by: Krishnankutty Kolathappilly --- drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c index ab074ffbcdfb..b9018a226f2f 100644 --- a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c +++ b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c @@ -3031,8 +3031,7 @@ STREAM_BUFF_END: uint32_t identity; struct msm_cpp_buff_queue_info_t *buff_queue_info; CPP_DBG("VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO\n"); - if ((ioctl_ptr->len == 0) || - (ioctl_ptr->len > sizeof(uint32_t))) { + if (ioctl_ptr->len != sizeof(uint32_t)) { mutex_unlock(&cpp_dev->mutex); return -EINVAL; } -- cgit v1.2.3