A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: vidc: Ensure size of the data available before typecasting

Browse source 
Ensure the available data size with in the packet before type
casting from a smaller data type to larger data type in order
to avoid information leak or packet out of boundary access.

Change-Id: I8614a8b3f930c87af8aa49f77ea9d768a73ea203
Signed-off-by: Priyanka Gujjula <pgujjula@codeaurora.org>
This commit is contained in:
Priyanka Gujjula 2019-07-03 18:29:44 +05:30
commit 3be0ff3910
3 changed files with 22 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

30
msm/vidc/hfi_response_handler.c
View file

@ -334,6 +334,12 @@ static int hfi_process_evt_release_buffer_ref(u32 device_id,
dprintk(VIDC_ERR, "%s: bad_pkt_size\n", __func__);
return -E2BIG;
}
if (pkt->size < sizeof(struct hfi_msg_event_notify_packet) - sizeof(u32)
+ sizeof(struct hfi_msg_release_buffer_ref_event_packet)) {
dprintk(VIDC_ERR, "%s: bad_pkt_size: %d\n",
__func__, pkt->size);
return -E2BIG;
}
data = (struct hfi_msg_release_buffer_ref_event_packet *)
pkt->rg_ext_event_data;
@ -762,15 +768,13 @@ static int hfi_process_session_etb_done(u32 device_id,
struct hfi_msg_session_empty_buffer_done_packet *pkt = _pkt;
struct msm_vidc_cb_data_done data_done = {0};
struct hfi_picture_type *hfi_picture_type = NULL;
u32 is_sync_frame;
dprintk(VIDC_LOW, "RECEIVED: SESSION_ETB_DONE[%#x]\n", pkt->session_id);
if (!pkt || pkt->size <
sizeof(struct hfi_msg_session_empty_buffer_done_packet)) {
dprintk(VIDC_ERR,
"hal_process_session_etb_done: bad_pkt_size\n");
return -E2BIG;
}
sizeof(struct hfi_msg_session_empty_buffer_done_packet))
goto bad_packet_size;
data_done.device_id = device_id;
data_done.session_id = (void *)(uintptr_t)pkt->session_id;
@ -790,8 +794,13 @@ static int hfi_process_session_etb_done(u32 device_id,
data_done.input_done.extra_data_buffer = pkt->extra_data_buffer;
data_done.input_done.status =
hfi_map_err_status(pkt->error_type);
hfi_picture_type = (struct hfi_picture_type *)&pkt->rgData[0];
if (hfi_picture_type->is_sync_frame) {
is_sync_frame = pkt->rgData[0];
if (is_sync_frame) {
if (pkt->size <
sizeof(struct hfi_msg_session_empty_buffer_done_packet)
+ sizeof(struct hfi_picture_type))
goto bad_packet_size;
hfi_picture_type = (struct hfi_picture_type *)&pkt->rgData[1];
if (hfi_picture_type->picture_type)
data_done.input_done.flags =
hfi_picture_type->picture_type;
@ -808,6 +817,10 @@ static int hfi_process_session_etb_done(u32 device_id,
info->response.data = data_done;
return 0;
bad_packet_size:
dprintk(VIDC_ERR, "%s: bad_pkt_size: %d\n",
__func__, pkt ? pkt->size : 0);
return -E2BIG;
}
static int hfi_process_session_ftb_done(
@ -1038,8 +1051,7 @@ static int hfi_process_session_rel_buf_done(u32 device_id,
cmd_done.size = sizeof(struct msm_vidc_cb_cmd_done);
cmd_done.session_id = (void *)(uintptr_t)pkt->session_id;
cmd_done.status = hfi_map_err_status(pkt->error_type);
cmd_done.data.buffer_info =
*(struct hal_buffer_info *)pkt->rg_buffer_info;
cmd_done.data.buffer_info.buffer_addr = *pkt->rg_buffer_info;
cmd_done.size = sizeof(struct hal_buffer_info);
info->response_type = HAL_SESSION_RELEASE_BUFFER_DONE;

2
msm/vidc/vidc_hfi.h
View file

@ -589,7 +589,7 @@ struct hfi_msg_session_empty_buffer_done_packet {
u32 extra_data_buffer;
u32 flags;
struct hfi_frame_cr_stats_type ubwc_cr_stats;
u32 rgData[0];
u32 rgData[1];
};
struct hfi_msg_session_fill_buffer_done_compressed_packet {

1
msm/vidc/vidc_hfi_helper.h
View file

@ -659,7 +659,6 @@ struct hfi_bit_depth {
};
struct hfi_picture_type {
u32 is_sync_frame;
u32 picture_type;
};