import PULS_20180308

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / misc / mediatek / masp / asf / core / sec_mod_core.c

diff --git a/drivers/misc/mediatek/masp/asf/core/sec_mod_core.c b/drivers/misc/mediatek/masp/asf/core/sec_mod_core.c
index 922be8189b624c2a295ec9acf4e74c1104994201..de6152670cc8d0d50ba17c2cefebc7cfa9bac469 100644 (file)
--- a/drivers/misc/mediatek/masp/asf/core/sec_mod_core.c
+++ b/drivers/misc/mediatek/masp/asf/core/sec_mod_core.c
@@ -262,7 +262,12 @@ long sec_core_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
             {
                 return -EFAULT;
             }
-            
+
+            if (hevc_blk.len > HEVC_BLK_LEN) {
+                SMSG(TRUE, "[%s] eop block size is too large!", MOD);
+                return -EFAULT;
+            }
+
             if ((hevc_blk.len % CI_BLK_SIZE) == 0)
             {
                 cipher_len = hevc_blk.len;
@@ -290,6 +295,11 @@ long sec_core_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 return -EFAULT;
             }
 
+            if (hevc_blk.len > HEVC_BLK_LEN) {
+                SMSG(TRUE, "[%s] dop block size is too large!", MOD);
+                return -EFAULT;
+            }
+
             if ((hevc_blk.len % CI_BLK_SIZE) == 0)
             {
                 cipher_len = hevc_blk.len;