media: tegra: camera: Fix stack overread
Amey Asgaonkar [Mon, 16 May 2016 23:33:15 +0000 (16:33 -0700)]
We are not checking a variable which is user
controlled. This can lead to reading of the
stack data. Adding a check to ensure it is
less than the max possible value of the variable.

Bug 1763649

Change-Id: I395e882d030199bdd7684837906a9b5d60741650
Signed-off-by: Amey Asgaonkar <aasgaonkar@nvidia.com>
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: http://git-master/r/1150943
(cherry picked from commit 14359cb871606ffefa4ca2070b7e9ccb08dcd378)
Reviewed-on: http://git-master/r/1260833
Reviewed-by: Shreshtha Sahu <ssahu@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Christian Gonzalez <christiang@nvidia.com>
Tested-by: Christian Gonzalez <christiang@nvidia.com>

drivers/media/platform/tegra/cam_dev/virtual.c

index 46303eb..1e70f48 100644 (file)
@@ -364,6 +364,12 @@ static int virtual_device_sanity_check(
                        __func__, pvd->clk_num);
        }
 
+       if (pvd->reg_num >= VIRTUAL_DEV_MAX_REGULATORS) {
+               dev_err(dev, "%s too many regulators %u!\n",
+                       __func__, pvd->reg_num);
+               return -ENODEV;
+       }
+
        *len = 0;
        num = pvd->reg_num;
        nptr = &pvd->reg_names[0];