From d17869edb9910167d30626372e32fd76e7c72cf1 Mon Sep 17 00:00:00 2001 From: ptak Date: Thu, 11 Jul 2024 12:25:03 +0530 Subject: [PATCH] msm: cvp: OOB write fix due to integer underflow If FW send a pkt->size which is less than the sizeof packet structure then pkt->size - sizeof() would result into an integer underflow. Due to this the subsequent check would be bypassed and we will start write to an OOB memory. Change-Id: Icb3e4e6d64275592ceb6f747de653dcc1c65fec7 Signed-off-by: ptak (cherry picked from commit 143f500168a79dfe3f1323d736e89828f7a1e6b0) --- drivers/media/platform/msm/cvp/hfi_response_handler.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/msm/cvp/hfi_response_handler.c b/drivers/media/platform/msm/cvp/hfi_response_handler.c index db857c210f3f..04c4c201fefa 100644 --- a/drivers/media/platform/msm/cvp/hfi_response_handler.c +++ b/drivers/media/platform/msm/cvp/hfi_response_handler.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2018-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2022-2024, Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -559,7 +560,7 @@ static void hfi_process_sys_get_prop_image_version( int req_bytes; req_bytes = pkt->size - sizeof(*pkt); - if (req_bytes < version_string_size || + if (req_bytes < (signed int)version_string_size || !pkt->rg_property_data[1] || pkt->num_properties > 1) { dprintk(CVP_ERR, "%s: bad_pkt: %d\n", __func__, req_bytes);