hal-backend-power: Fix possible vulnerabilitiestizen_8.0_m2_releasetizen_7.0_m2_releaseaccepted/tizen/unified/20220908.013424accepted/tizen/8.0/unified/20231005.094453accepted/tizen/7.0/unified/hotfix/20221116.110405accepted/tizen/7.0/unified/20221110.060940tizen_8.0tizen_7.0_hotfixtizen_7.0accepted/tizen_8.0_unifiedaccepted/tizen_7.0_unified_hotfixaccepted/tizen_7.0_unified

Change-Id: Iaa52e60e5d74c32bafbb200a49dc741e2a49c452
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>

1 files changed, 15 insertions, 9 deletions

diff --git a/src/hal-backend-power.c b/src/hal-backend-power.c
index ce7606f..71063b4 100644
--- a/src/hal-backend-power.c
+++ b/src/hal-backend-power.c
@@ -20,7 +20,6 @@
 #include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <string.h>
 
 #include <hal/hal-power-interface.h>
 
@@ -366,14 +365,17 @@ static struct pass_resource_tmu_ops tmu_ops = {
 static int bus_dvfs_get_curr_freq(char *res_name)
 {
 	char buf[BUFF_MAX + 1];
-	char unit[BUFF_MAX + 1];
 	int ret, freq;
 
 	ret = sysfs_read_str("/sys/class/aml_ddr/freq", buf, BUFF_MAX);
 	if (ret < 0)
 		return ret;
 
-	sscanf(buf, "%d %s", &freq, unit);
+	if (sscanf(buf, "%d %*s", &freq) != 1)
+		return -EINVAL;
+
+	if (freq < 0 || freq > INT_MAX/1000)
+		return -EINVAL;
 
 	return (freq * 1000);
 }
@@ -386,13 +388,17 @@ static int gpu_freq_table[] = {
 	800000,
 };
 
+#define ARRAY_LENGTH(array) (sizeof((array))/sizeof((array)[0]))
+
 static int gpu_dvfs_get_min_freq(char *res_name)
 {
 	int freq, ret;
 
 	ret = sysfs_read_int("/sys/class/mpgpu/min_freq", &freq);
-	if (ret < 0)
-		return ret;
+
+	if (freq < 0 || freq >= ARRAY_LENGTH(gpu_freq_table))
+		return -EINVAL;
+
 	return (ret < 0) ? ret : (gpu_freq_table[freq]);
 }
 
@@ -401,8 +407,9 @@ static int gpu_dvfs_get_max_freq(char *res_name)
 	int freq, ret;
 
 	ret = sysfs_read_int("/sys/class/mpgpu/max_freq", &freq);
-	if (ret < 0)
-		return ret;
+	if (freq < 0 || freq >= ARRAY_LENGTH(gpu_freq_table))
+		return -EINVAL;
+
 	return (ret < 0) ? ret : gpu_freq_table[freq];
 }
 
@@ -411,8 +418,7 @@ static int gpu_dvfs_get_curr_freq(char *res_name)
 	int freq, ret;
 
 	ret = sysfs_read_int("/sys/class/mpgpu/cur_freq", &freq);
-	if (ret < 0)
-		return ret;
+
 	return (ret < 0) ? ret : (freq * 1000);
 }