diff options
| author | Depeng Shao <dshao@codeaurora.org> | 2017-05-12 14:27:30 +0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-05-15 03:25:54 -0700 |
| commit | 4f19bb77fe0967e4e8aab34a66829618c4927d1f (patch) | |
| tree | 1d66237b0a8be9effbc7b7cb0f736e307b010aff /drivers/media | |
| parent | c6d1c1699e7dcc7ec170baae48be94814061d0b7 (diff) | |
msm: camera: sensor: Validate sensor related name length
Variable "slave_info->sensor_name", "slave_info->eeprom_name",
"slave_info->actuator_name" and "slave_info->ois_name" are
from user input, which may be not NULL terminated.
OOB will be possible when accessing these variable.
Add a validation for these name length.
Change-Id: I9a570372707b7f8365a625d6b0662e87d1b4926e
Signed-off-by: Depeng Shao <dshao@codeaurora.org>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c b/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c index 7027fedaf721..940ab36ffb3e 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c +++ b/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c @@ -793,6 +793,21 @@ int32_t msm_sensor_driver_probe(void *setting, } } + if (strlen(slave_info->sensor_name) >= MAX_SENSOR_NAME || + strlen(slave_info->eeprom_name) >= MAX_SENSOR_NAME || + strlen(slave_info->actuator_name) >= MAX_SENSOR_NAME || + strlen(slave_info->ois_name) >= MAX_SENSOR_NAME) { + pr_err("failed: name len greater than 32.\n"); + pr_err("sensor name len:%zu, eeprom name len: %zu.\n", + strlen(slave_info->sensor_name), + strlen(slave_info->eeprom_name)); + pr_err("actuator name len: %zu, ois name len:%zu.\n", + strlen(slave_info->actuator_name), + strlen(slave_info->ois_name)); + rc = -EINVAL; + goto free_slave_info; + } + /* Print slave info */ CDBG("camera id %d Slave addr 0x%X addr_type %d\n", slave_info->camera_id, slave_info->slave_addr, |