From b5ac2b42fdd2fffc9d887f43491715d2f733497f Mon Sep 17 00:00:00 2001 From: Pratap Nirujogi Date: Mon, 20 Feb 2017 17:29:33 +0530 Subject: msm: camera: cpp: Fixing Heap overflow in output buffer Issue: Missing bound check when writing into the output array buffer, which can lead to out-of-bound heap write. Fix: Addding hardcoded constant 8 in the MSM_OUTPUT_BUF_CNT macro and size check to the place where the array is accessed. Returning '0' if exceeds MSM_OUTPUT_BUF_CNT. Caller will return -EINVAL for '0'. Change-Id: Ic03f86e3e47ece9ca7069527e741a75ad9a0f83f CRs-Fixed: 2004036 Signed-off-by: Pratap Nirujogi --- include/uapi/media/msmb_pproc.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include/uapi') diff --git a/include/uapi/media/msmb_pproc.h b/include/uapi/media/msmb_pproc.h index b65669b87a21..8f454571e69d 100644 --- a/include/uapi/media/msmb_pproc.h +++ b/include/uapi/media/msmb_pproc.h @@ -16,6 +16,7 @@ #define MSM_CPP_MAX_FRAME_LENGTH 4096 #define MSM_CPP_MAX_FW_NAME_LEN 32 #define MAX_FREQ_TBL 10 +#define MSM_OUTPUT_BUF_CNT 8 enum msm_cpp_frame_type { MSM_CPP_OFFLINE_FRAME, @@ -76,7 +77,7 @@ struct msm_cpp_frame_info_t { uint32_t feature_mask; uint8_t we_disable; struct msm_cpp_buffer_info_t input_buffer_info; - struct msm_cpp_buffer_info_t output_buffer_info[8]; + struct msm_cpp_buffer_info_t output_buffer_info[MSM_OUTPUT_BUF_CNT]; struct msm_cpp_buffer_info_t duplicate_buffer_info; struct msm_cpp_buffer_info_t tnr_scratch_buffer_info[2]; uint32_t reserved; -- cgit v1.2.3