Piteball/android_kernel_samsung_msm8976
1
1
Fork 0
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git synced 2024-10-31 18:09:19 +00:00
Code Issues Projects Releases Wiki Activity

Revert "msm: vidc: Add checks to avoid OOB access."

Browse source 
This reverts commit 6ebcce85991d8f4d6487c2c09790ea3275e70f21.

Change-Id: I8694bb93bd9f86fd042b6a31c0fc52390916de2c
Signed-off-by: Sanjay Singh <sisanj@codeaurora.org>
This commit is contained in:
Sanjay Singh 2019-11-12 17:17:37 +05:30 committed by syphyr
parent 8af369dae9
commit 62d6b9418e
1 changed files with 18 additions and 92 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

106
drivers/media/platform/msm/vidc/hfi_response_handler.c
View file

@ -709,21 +709,6 @@ static enum vidc_status hfi_parse_init_done_properties(
enum vidc_status status = VIDC_ERR_NONE; enum vidc_status status = VIDC_ERR_NONE;
u32 prop_id, next_offset; u32 prop_id, next_offset;
#define VALIDATE_PROPERTY_STRUCTURE_SIZE(pkt_size, property_size) ({\
if (pkt_size < property_size) { \
status = VIDC_ERR_BAD_PARAM; \
break; \
} \
})
#define VALIDATE_PROPERTY_PAYLOAD_SIZE(pkt_size, payload_size, \
property_count) ({\
if (pkt_size/payload_size < property_count) { \
status = VIDC_ERR_BAD_PARAM; \
break; \
} \
})
while (status == VIDC_ERR_NONE && num_properties && while (status == VIDC_ERR_NONE && num_properties &&
rem_bytes >= sizeof(u32)) { rem_bytes >= sizeof(u32)) {
@ -737,10 +722,6 @@ static enum vidc_status hfi_parse_init_done_properties(
(struct hfi_codec_mask_supported *) (struct hfi_codec_mask_supported *)
(data_ptr + next_offset); (data_ptr + next_offset);
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -
next_offset,
sizeof(*prop));
codecs = prop->codecs; codecs = prop->codecs;
domain = prop->video_domains; domain = prop->video_domains;
next_offset += sizeof(struct hfi_codec_mask_supported); next_offset += sizeof(struct hfi_codec_mask_supported);
@ -753,14 +734,11 @@ static enum vidc_status hfi_parse_init_done_properties(
(struct hfi_capability_supported_info *) (struct hfi_capability_supported_info *)
(data_ptr + next_offset); (data_ptr + next_offset);
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes - if ((rem_bytes - next_offset) < prop->num_capabilities *
next_offset, sizeof(struct hfi_capability_supported)) {
sizeof(*prop)); status = VIDC_ERR_BAD_PARAM;
VALIDATE_PROPERTY_PAYLOAD_SIZE(rem_bytes - break;
next_offset - sizeof(u32), }
sizeof(struct hfi_capability_supported),
prop->num_capabilities);
next_offset += sizeof(u32) + next_offset += sizeof(u32) +
prop->num_capabilities * prop->num_capabilities *
sizeof(struct hfi_capability_supported); sizeof(struct hfi_capability_supported);
@ -782,10 +760,10 @@ static enum vidc_status hfi_parse_init_done_properties(
char *fmt_ptr; char *fmt_ptr;
struct hfi_uncompressed_plane_info *plane_info; struct hfi_uncompressed_plane_info *plane_info;
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes - if ((rem_bytes - next_offset) < sizeof(*prop)) {
next_offset, status = VIDC_ERR_BAD_PARAM;
sizeof(*prop)); break;
}
num_format_entries = prop->format_entries; num_format_entries = prop->format_entries;
next_offset = sizeof(*prop); next_offset = sizeof(*prop);
fmt_ptr = (char *)&prop->rg_format_info[0]; fmt_ptr = (char *)&prop->rg_format_info[0];
@ -795,10 +773,11 @@ static enum vidc_status hfi_parse_init_done_properties(
plane_info = plane_info =
(struct hfi_uncompressed_plane_info *) fmt_ptr; (struct hfi_uncompressed_plane_info *) fmt_ptr;
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes - if ((rem_bytes - next_offset) <
next_offset, sizeof(*plane_info)) {
sizeof(*plane_info)); status = VIDC_ERR_BAD_PARAM;
break;
}
bytes_to_skip = sizeof(*plane_info) - bytes_to_skip = sizeof(*plane_info) -
sizeof(struct sizeof(struct
hfi_uncompressed_plane_constraints) + hfi_uncompressed_plane_constraints) +
@ -806,10 +785,6 @@ static enum vidc_status hfi_parse_init_done_properties(
sizeof(struct sizeof(struct
hfi_uncompressed_plane_constraints); hfi_uncompressed_plane_constraints);
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -
next_offset,
bytes_to_skip);
fmt_ptr += bytes_to_skip; fmt_ptr += bytes_to_skip;
next_offset += bytes_to_skip; next_offset += bytes_to_skip;
num_format_entries--; num_format_entries--;
@ -822,15 +797,6 @@ static enum vidc_status hfi_parse_init_done_properties(
struct hfi_properties_supported *prop = struct hfi_properties_supported *prop =
(struct hfi_properties_supported *) (struct hfi_properties_supported *)
(data_ptr + next_offset); (data_ptr + next_offset);
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -
next_offset,
sizeof(*prop));
VALIDATE_PROPERTY_PAYLOAD_SIZE(rem_bytes -
next_offset - sizeof(*prop) +
sizeof(u32), sizeof(u32),
prop->num_properties);
next_offset += sizeof(*prop) - sizeof(u32) next_offset += sizeof(*prop) - sizeof(u32)
+ prop->num_properties * sizeof(u32); + prop->num_properties * sizeof(u32);
num_properties--; num_properties--;
@ -847,19 +813,8 @@ static enum vidc_status hfi_parse_init_done_properties(
(struct hfi_profile_level_supported *) (struct hfi_profile_level_supported *)
(data_ptr + next_offset); (data_ptr + next_offset);
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -
next_offset,
sizeof(*prop));
ptr = (char *) &prop->rg_profile_level[0]; ptr = (char *) &prop->rg_profile_level[0];
prof_count = prop->profile_count; prof_count = prop->profile_count;
VALIDATE_PROPERTY_PAYLOAD_SIZE(rem_bytes -
next_offset -
sizeof(u32),
sizeof(struct hfi_profile_level),
prop->profile_count);
next_offset += sizeof(u32); next_offset += sizeof(u32);
if (prof_count > MAX_PROFILE_COUNT) { if (prof_count > MAX_PROFILE_COUNT) {
@ -886,9 +841,6 @@ static enum vidc_status hfi_parse_init_done_properties(
} }
case HFI_PROPERTY_PARAM_INTERLACE_FORMAT_SUPPORTED: case HFI_PROPERTY_PARAM_INTERLACE_FORMAT_SUPPORTED:
{ {
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -
next_offset,
sizeof(struct hfi_interlace_format_supported));
next_offset += next_offset +=
sizeof(struct hfi_interlace_format_supported); sizeof(struct hfi_interlace_format_supported);
num_properties--; num_properties--;
@ -896,9 +848,6 @@ static enum vidc_status hfi_parse_init_done_properties(
} }
case HFI_PROPERTY_PARAM_NAL_STREAM_FORMAT_SUPPORTED: case HFI_PROPERTY_PARAM_NAL_STREAM_FORMAT_SUPPORTED:
{ {
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -
next_offset,
sizeof(struct hfi_nal_stream_format_supported));
next_offset += next_offset +=
sizeof(struct hfi_nal_stream_format_supported); sizeof(struct hfi_nal_stream_format_supported);
num_properties--; num_properties--;
@ -906,27 +855,18 @@ static enum vidc_status hfi_parse_init_done_properties(
} }
case HFI_PROPERTY_PARAM_NAL_STREAM_FORMAT_SELECT: case HFI_PROPERTY_PARAM_NAL_STREAM_FORMAT_SELECT:
{ {
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -
next_offset,
sizeof(u32));
next_offset += sizeof(u32); next_offset += sizeof(u32);
num_properties--; num_properties--;
break; break;
} }
case HFI_PROPERTY_PARAM_MAX_SEQUENCE_HEADER_SIZE: case HFI_PROPERTY_PARAM_MAX_SEQUENCE_HEADER_SIZE:
{ {
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -
next_offset,
sizeof(u32));
next_offset += sizeof(u32); next_offset += sizeof(u32);
num_properties--; num_properties--;
break; break;
} }
case HFI_PROPERTY_PARAM_VENC_INTRA_REFRESH: case HFI_PROPERTY_PARAM_VENC_INTRA_REFRESH:
{ {
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -
next_offset,
sizeof(struct hfi_intra_refresh));
next_offset += next_offset +=
sizeof(struct hfi_intra_refresh); sizeof(struct hfi_intra_refresh);
num_properties--; num_properties--;
@ -938,24 +878,15 @@ static enum vidc_status hfi_parse_init_done_properties(
(struct hfi_buffer_alloc_mode_supported *) (struct hfi_buffer_alloc_mode_supported *)
(data_ptr + next_offset); (data_ptr + next_offset);
VALIDATE_PROPERTY_STRUCTURE_SIZE(rem_bytes -
next_offset,
sizeof(*prop));
next_offset += sizeof(struct hfi_buffer_alloc_mode_supported);
if (prop->num_entries >= 32) { if (prop->num_entries >= 32) {
dprintk(VIDC_ERR, dprintk(VIDC_ERR,
"%s - num_entries: %d from f/w seems suspect\n", "%s - num_entries: %d from f/w seems suspect\n",
__func__, prop->num_entries); __func__, prop->num_entries);
break; break;
} }
VALIDATE_PROPERTY_PAYLOAD_SIZE(rem_bytes -
next_offset +
sizeof(u32),
sizeof(u32),
prop->num_entries);
next_offset += next_offset +=
prop->num_entries * sizeof(u32) - sizeof(u32); sizeof(struct hfi_buffer_alloc_mode_supported) -
sizeof(u32) + prop->num_entries * sizeof(u32);
copy_alloc_mode_to_sessions(prop, copy_alloc_mode_to_sessions(prop,
capabilities, num_sessions, capabilities, num_sessions,
@ -970,13 +901,8 @@ static enum vidc_status hfi_parse_init_done_properties(
__func__, data_ptr, prop_id); __func__, data_ptr, prop_id);
break; break;
} }
if (rem_bytes > next_offset) {
rem_bytes -= next_offset; rem_bytes -= next_offset;
data_ptr += next_offset; data_ptr += next_offset;
} else {
rem_bytes = 0;
}
} }
return status; return status;