media: tegra: camera: Fix stack overread
Amey Asgaonkar [Mon, 16 May 2016 23:33:15 +0000 (16:33 -0700)]
We are not checking a variable which is user
controlled. This can lead to reading of the
stack data. Adding a check to ensure it is
less than the max possible value of the variable.

Bug 1763649

Change-Id: I395e882d030199bdd7684837906a9b5d60741650
Signed-off-by: Amey Asgaonkar <aasgaonkar@nvidia.com>
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: http://git-master/r/1150943
GVS: Gerrit_Virtual_Submit
Reviewed-by: Matthew Pedro <mapedro@nvidia.com>

drivers/media/platform/tegra/cam_dev/virtual.c

index ce20eae..e151068 100644 (file)
@@ -332,6 +332,12 @@ static int virtual_device_sanity_check(
                        __func__, dev_info->clk_num);
        }
 
+       if (dev_info->reg_num >= VIRTUAL_DEV_MAX_REGULATORS) {
+               dev_err(dev, "%s too many regulators %u!\n",
+                       __func__, dev_info->reg_num);
+               return -ENODEV;
+       }
+
        *len = 0;
        num = dev_info->reg_num;
        nptr = &dev_info->reg_names[0];