From 6c445cfb01ae2b25a0cb208b01161df41cf76d81 Mon Sep 17 00:00:00 2001 From: Shravan Nevatia Date: Tue, 29 Mar 2022 10:54:51 +0530 Subject: [PATCH] msm: camera: eeprom: Add OOB read check for eeprom memory map Add check to prevent OOB read of eeprom memory map. Change-Id: Ifeeeffdc2a50536edbde5b5d755a052ace86d596 CRs-Fixed: 3003049 Signed-off-by: Shravan Nevatia --- drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c index 78130f6a66de..61f40ff3c04c 100644 --- a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c +++ b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -997,7 +998,15 @@ static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl, rc = -EINVAL; goto end; } + + if ((num_map + 1) >= (MSM_EEPROM_MAX_MEM_MAP_CNT * + MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) { + CAM_ERR(CAM_EEPROM, "OOB map read error"); + rc = -EINVAL; + goto end; + } /* Configure the following map slave address */ + map[num_map + 1].saddr = i2c_info->slave_addr; rc = cam_eeprom_update_slaveInfo(e_ctrl, cmd_buf);