NekoCWD/libcamera
NekoCWD/libcamera
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 7 Wiki Activity Actions

ipa: raspberrypi: Fix possible buffer overrun in metadata parsing

Browse source 
The SMIA metadata parser could possibly read one byte past the end of the
buffer as the buffer size test ran after the read operation. Fix this.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: David Plowman <david.plowman@raspberrypi.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
This commit is contained in:
Naushir Patuck 2021-06-15 15:42:10 +01:00 • committed by Laurent Pinchart
parent 969da31894
commit a4b876e97f
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/ipa/raspberrypi/md_parser_smia.cpp
View file

@ -71,8 +71,8 @@ MdParserSmia::ParseStatus MdParserSmia::findRegs(libcamera::Span<const uint8_t>
return NO_LINE_START;
} else {
/* allow a zero line length to mean "hunt for the next line" */
while (buffer[current_offset] != LINE_START &&
current_offset < buffer.size())
while (current_offset < buffer.size() &&
buffer[current_offset] != LINE_START)
current_offset++;
if (current_offset == buffer.size())