diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-07-04 01:20:52 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-07-04 01:20:51 -0700 |
| commit | 4d8e12a8e6830e6d1e136b7f47eadb2f23eb2500 (patch) | |
| tree | 44bff630dcb5348ded3b922e2f21af69b36223c9 | |
| parent | caad37816ba53a740355f1f6f2b26171f5cd9d91 (diff) | |
| parent | 6724296d3f3b2821b83219768c1b9e971e380a9f (diff) | |
Merge "msm: camera: isp: Handle array out of bound access"
| -rw-r--r-- | drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c b/drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c index 373a963f75aa..a85ee30769c4 100644 --- a/drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c +++ b/drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c @@ -3889,6 +3889,12 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg) case UPDATE_STREAM_REQUEST_FRAMES_VER2: { struct msm_vfe_axi_stream_cfg_update_info_req_frm *req_frm = &update_cmd->req_frm_ver2; + if (HANDLE_TO_IDX(req_frm->stream_handle) >= VFE_AXI_SRC_MAX) { + pr_err("%s: Invalid stream handle\n", __func__); + rc = -EINVAL; + break; + } + stream_info = &axi_data->stream_info[HANDLE_TO_IDX( req_frm->stream_handle)]; rc = msm_isp_request_frame(vfe_dev, stream_info, |