From b375ca6675491b4d6d1b8d4a152c949e45e0922b Mon Sep 17 00:00:00 2001 From: Vikash Garodia Date: Wed, 29 Nov 2023 09:32:28 +0530 Subject: [PATCH] BACKPORT: media: venus: hfi: fix the check in session buffer requirement Buffer requirement, for different buffer type, comes from video firmware. While copying these requirements, there is an OOB possibility when the payload from firmware is more than expected size. Fix the check to avoid the OOB possibility. cherry picked from b18e36dfd6c9 ("media: venus: hfi: fix the check to handle session buffer requirement"). Change-Id: I8169c57b2c244c52bac0b4de460b9820707f6ff7 Cc: stable@vger.kernel.org Fixes: 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware Interface (HFI)") Reviewed-by: Nathan Hebert Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil Signed-off-by: Vikash Garodia (cherry picked from commit 8346a4a3b40d2075635723f537952a8e27dfc949) --- drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/qcom/venus/hfi_msgs.c b/drivers/media/platform/qcom/venus/hfi_msgs.c index 04ef2286efc6..5694d18b43d5 100644 --- a/drivers/media/platform/qcom/venus/hfi_msgs.c +++ b/drivers/media/platform/qcom/venus/hfi_msgs.c @@ -350,7 +350,7 @@ session_get_prop_buf_req(struct hfi_msg_session_property_info_pkt *pkt, memcpy(&bufreq[idx], buf_req, sizeof(*bufreq)); idx++; - if (idx > HFI_BUFFER_TYPE_MAX) + if (idx >= HFI_BUFFER_TYPE_MAX) return HFI_ERR_SESSION_INVALID_PARAMETER; req_bytes -= sizeof(struct hfi_buffer_requirements);