From 38aa413f2e96ac1f09878538ec9bf082cc3207d6 Mon Sep 17 00:00:00 2001 From: Sunyoung Kang Date: Wed, 24 Oct 2018 17:04:59 +0900 Subject: [PATCH] [RAMEN9610-10029][COMMON] media: mfc: fix Out-of-Bound defect This adds to check the size of copy_from_user(). Change-Id: Icb869f2906881889305beea6b4fb3bbd9ef14f08 Signed-off-by: Sunyoung Kang --- drivers/media/platform/exynos/mfc/mfc_enc_v4l2.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/platform/exynos/mfc/mfc_enc_v4l2.c b/drivers/media/platform/exynos/mfc/mfc_enc_v4l2.c index 91d1107f8df5..e64ce08206c5 100644 --- a/drivers/media/platform/exynos/mfc/mfc_enc_v4l2.c +++ b/drivers/media/platform/exynos/mfc/mfc_enc_v4l2.c @@ -1908,6 +1908,11 @@ static int __mfc_enc_set_ctrl_val(struct mfc_ctx *ctx, struct v4l2_control *ctrl memcpy(&enc->roi_info[index], enc->sh_handle_roi.vaddr, sizeof(struct mfc_enc_roi_info)); + if (enc->roi_info[index].size > enc->roi_buf[index].size) { + mfc_err_ctx("[MEMINFO][ROI] roi info size %d is over\n", + enc->roi_info[index].size); + return -EINVAL; + } if (copy_from_user(enc->roi_buf[index].vaddr, enc->roi_info[index].addr, enc->roi_info[index].size)) -- 2.20.1