From 14359cb871606ffefa4ca2070b7e9ccb08dcd378 Mon Sep 17 00:00:00 2001 From: Amey Asgaonkar Date: Mon, 16 May 2016 16:33:15 -0700 Subject: media: tegra: camera: Fix stack overread We are not checking a variable which is user controlled. This can lead to reading of the stack data. Adding a check to ensure it is less than the max possible value of the variable. Bug 1763649 Change-Id: I395e882d030199bdd7684837906a9b5d60741650 Signed-off-by: Amey Asgaonkar Signed-off-by: Bibek Basu Reviewed-on: http://git-master/r/1150943 GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro --- drivers/media/platform/tegra/cam_dev/virtual.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/tegra/cam_dev/virtual.c b/drivers/media/platform/tegra/cam_dev/virtual.c index ce20eae86b9f..e151068fa377 100644 --- a/drivers/media/platform/tegra/cam_dev/virtual.c +++ b/drivers/media/platform/tegra/cam_dev/virtual.c @@ -332,6 +332,12 @@ static int virtual_device_sanity_check( __func__, dev_info->clk_num); } + if (dev_info->reg_num >= VIRTUAL_DEV_MAX_REGULATORS) { + dev_err(dev, "%s too many regulators %u!\n", + __func__, dev_info->reg_num); + return -ENODEV; + } + *len = 0; num = dev_info->reg_num; nptr = &dev_info->reg_names[0]; -- cgit v1.2.3