From 720369dfcf81bbaad89c5453bb7e3beab4a958f6 Mon Sep 17 00:00:00 2001 From: Vikash Garodia Date: Thu, 26 Dec 2019 16:30:39 +0530 Subject: [PATCH] msm: vidc: ensure the validity of video buffer access During subsystem failure, the cause for failure is updated in a specific video buffer by the video firmware. Video firmware can even update the size of that specific buffer. To ensure the validity of that buffer access, check if the access is within the allocated size. CRs-Fixed: 2585811 Change-Id: I30b8bf2e9ba3699d229f4acc104f46566fcb60fa Signed-off-by: Vikash Garodia --- msm/vidc/hfi_common.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/msm/vidc/hfi_common.c b/msm/vidc/hfi_common.c index 523475a9762a..04799b26585d 100644 --- a/msm/vidc/hfi_common.c +++ b/msm/vidc/hfi_common.c @@ -2519,6 +2519,11 @@ static void print_sfr_message(struct venus_hfi_device *device) vsfr = (struct hfi_sfr_struct *)device->sfr.align_virtual_addr; if (vsfr) { + if (vsfr->bufSize != device->sfr.mem_size) { + d_vpr_e("Invalid SFR buf size %d actual %d\n", + vsfr->bufSize, device->sfr.mem_size); + return; + } vsfr_size = vsfr->bufSize - sizeof(u32); p = memchr(vsfr->rg_data, '\0', vsfr_size); /* SFR isn't guaranteed to be NULL terminated */