diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-06-06 13:21:36 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-06-06 13:21:36 -0700 |
| commit | 37bca2d3379afeefc42a500730ab3136d3d2de1e (patch) | |
| tree | 3c7d29ca6ec94e4d08f38f2b676832ed0ad080f8 | |
| parent | f8465303248ab97a729792eb4e42b681723449d2 (diff) | |
| parent | 755261330733bb2440907a8407ed691c99451ddc (diff) | |
Merge "msm: camera: isp: Add bound check for an array"
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c index f9809615b407..08a8135ea9f4 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c @@ -2480,6 +2480,12 @@ int msm_isp_ab_ib_update_lpm_mode(struct vfe_device *vfe_dev, void *arg) rc = -1; return rc; } + if (ab_ib_vote->num_src >= VFE_AXI_SRC_MAX) { + pr_err("%s: ab_ib_vote num_src is exceeding limit\n", + __func__); + rc = -1; + return rc; + } if (ab_ib_vote->lpm_mode) { for (i = 0; i < ab_ib_vote->num_src; i++) { stream_info = |