Skip to content
Snippets Groups Projects
Commit f2402f4d authored by Satyanarayana Dash's avatar Satyanarayana Dash
Browse files

msm: camera: isp: Handle array out of bounds


The pointer qbuf_buf comes from userspace.
qbuf_buf->num_planes is used with no bound check,
which if set to a large value, it will overflow
buf_info->mapped_info and qbuf_buf->planes

Bug: 38196031

CRs-Fixed: 2003798
Change-Id: I332e0424e57bb14b481a740604a09350e6f029a8
Signed-off-by: default avatarSenthil Kumar Rajagopal <skrajago@codeaurora.org>
Signed-off-by: default avatarVijayaKumar T M <vtmuni@codeaurora.org>
Signed-off-by: default avatarSatyanarayana Dash <sadash@codeaurora.org>
parent a4e5f43d
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment