media: tegra: camera: Fix stack overread

We are not checking a variable which is user
controlled. This can lead to reading of the
stack data. Adding a check to ensure it is
less than the max possible value of the variable.

Bug 1763649

Change-Id: I395e882d030199bdd7684837906a9b5d60741650
Signed-off-by: Amey Asgaonkar <aasgaonkar@nvidia.com>
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: http://git-master/r/1150943
GVS: Gerrit_Virtual_Submit
Reviewed-by: Matthew Pedro <mapedro@nvidia.com>

diff --git a/drivers/media/platform/tegra/cam_dev/virtual.c b/drivers/media/platform/tegra/cam_dev/virtual.c
index ce20eae86b9f42e4bd2f16e57bbfb6c15ac4fa5b..e151068fa377e36c936ee618884ceaf06dba95f7 100644 (file)
--- a/drivers/media/platform/tegra/cam_dev/virtual.c
+++ b/drivers/media/platform/tegra/cam_dev/virtual.c
@@ -332,6 +332,12 @@ static int virtual_device_sanity_check(
                        __func__, dev_info->clk_num);
        }
 
+       if (dev_info->reg_num >= VIRTUAL_DEV_MAX_REGULATORS) {
+               dev_err(dev, "%s too many regulators %u!\n",
+                       __func__, dev_info->reg_num);
+               return -ENODEV;
+       }
+
        *len = 0;
        num = dev_info->reg_num;
        nptr = &dev_info->reg_names[0];