From: Jeongtae Park <jtp.park@samsung.com>
Date: Sun, 2 Dec 2018 09:47:06 +0000 (+0900)
Subject: [COMMON] fimc-is2: add validation checking for v4l2_buffer before copy them to pipe
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=47caada1c1e44d1d8e4ec29251ec83042875ba3c;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

[COMMON] fimc-is2: add validation checking for v4l2_buffer before copy them to pipe

PR JIRA ID: CPR-471

Change-Id: I25453e0135941848b5ea512f095e08ea5e9bca8e
Signed-off-by: Jeongtae Park <jtp.park@samsung.com>
---

diff --git a/drivers/media/platform/exynos/fimc-is2/fimc-is-video.c b/drivers/media/platform/exynos/fimc-is2/fimc-is-video.c
index fbb704eff59f..faa8585d6931 100644
--- a/drivers/media/platform/exynos/fimc-is2/fimc-is-video.c
+++ b/drivers/media/platform/exynos/fimc-is2/fimc-is-video.c
@@ -1785,6 +1785,25 @@ int fimc_is_video_prepare(struct file *file,
 			goto p_err;
 		}
 
+		if (!V4L2_TYPE_IS_MULTIPLANAR(buf->type)) {
+			mverr("the type of passed buffer is not multi-planar",
+					vctx, video);
+			ret = -EINVAL;
+			goto p_err;
+		}
+
+		if (!buf->m.planes) {
+			mverr("planes array not provided", vctx, video);
+			ret = -EINVAL;
+			goto p_err;
+		}
+
+		if (buf->length > FIMC_IS_MAX_PLANES) {
+			mverr("incorrect planes array length", vctx, video);
+			ret = -EINVAL;
+			goto p_err;
+		}
+
 		/* Destination */
 		memcpy(&pipe->buf[PIPE_SLOT_DST][index], buf, sizeof(struct v4l2_buffer));
 		memcpy(pipe->planes[PIPE_SLOT_DST][index], buf->m.planes, sizeof(struct v4l2_plane) * buf->length);