Skip to content
Snippets Groups Projects
Commit bcee276a authored by Vikash Garodia's avatar Vikash Garodia Committed by Greg Kroah-Hartman
Browse files

media: venus: hfi: fix the check to handle session buffer requirement


commit b18e36df upstream.

Buffer requirement, for different buffer type, comes from video firmware.
While copying these requirements, there is an OOB possibility when the
payload from firmware is more than expected size. Fix the check to avoid
the OOB possibility.

Cc: stable@vger.kernel.org
Fixes: 09c2845e ("[media] media: venus: hfi: add Host Firmware Interface (HFI)")
Reviewed-by: default avatarNathan Hebert <nhebert@chromium.org>
Signed-off-by: default avatarVikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: default avatarStanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent da240b7b
No related branches found
No related tags found
No related merge requests found
......@@ -351,7 +351,7 @@ session_get_prop_buf_req(struct hfi_msg_session_property_info_pkt *pkt,
memcpy(&bufreq[idx], buf_req, sizeof(*bufreq));
idx++;
if (idx > HFI_BUFFER_TYPE_MAX)
if (idx >= HFI_BUFFER_TYPE_MAX)
return HFI_ERR_SESSION_INVALID_PARAMETER;
req_bytes -= sizeof(struct hfi_buffer_requirements);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment