diff options
| author | Senthil Kumar Rajagopal <skrajago@codeaurora.org> | 2017-05-23 19:47:47 +0530 |
|---|---|---|
| committer | Senthil Kumar Rajagopal <skrajago@codeaurora.org> | 2017-05-23 21:02:00 +0530 |
| commit | 755261330733bb2440907a8407ed691c99451ddc (patch) | |
| tree | 4038526e4de161da80f7abc45f8039cb4190c32c | |
| parent | 60be71604a84d2e047215cb702d6324379a353bb (diff) | |
msm: camera: isp: Add bound check for an array
The value of ab_ib_vote->num_src comes from userspace.
This value is used as an index for accessing the array
stream_src. Adding bound check to avoid accessing beyond array limit.
Change-Id: I1d4555234ced24af7cd70b71ca43981fe8a3f366
Signed-off-by: Senthil Kumar Rajagopal <skrajago@codeaurora.org>
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c index f9809615b407..08a8135ea9f4 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c @@ -2480,6 +2480,12 @@ int msm_isp_ab_ib_update_lpm_mode(struct vfe_device *vfe_dev, void *arg) rc = -1; return rc; } + if (ab_ib_vote->num_src >= VFE_AXI_SRC_MAX) { + pr_err("%s: ab_ib_vote num_src is exceeding limit\n", + __func__); + rc = -1; + return rc; + } if (ab_ib_vote->lpm_mode) { for (i = 0; i < ab_ib_vote->num_src; i++) { stream_info = |