Maggie White e6882fa78f msm: camera: isp: fix for out of bound access array ...

There is no bound check in stream_cfg_cmd->num_streams and it's used in
several places as a maximum index into the stream_cfg_cmd->stream_handle
array which has a size of 15. Current code didn't check the maximum
index to make sure it didn't exceed the array size.

Bug: 62379525
Change-Id: Idcf639486d235551882dafc34d9e798d78c70bf0
Signed-off-by: Maggie White <maggiewhite@google.com>
CVE-2017-8251
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>

2019-08-08 12:08:30 +02:00

..

common

…

dvb

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

isdbt

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

isdbtmm

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

mtv

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

platform

msm: camera: isp: fix for out of bound access array

2019-08-08 12:08:30 +02:00

radio

radio: iris: Use kernel API to copy data from user space

2019-08-06 11:48:12 +02:00

rc

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

tdmb

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

video

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

Kconfig

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

Makefile

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

media-device.c

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

media-devnode.c

…

media-entity.c

…