diff options
| author | Terence Ho <terenceh@codeaurora.org> | 2017-06-14 16:05:57 -0400 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-07-07 15:30:22 -0700 |
| commit | 9dc644af5664a4cf1d07cd2419d027aa1e703b51 (patch) | |
| tree | 83a248e679ee04901c70aaf2c061ba9131c75722 | |
| parent | 3258c685591af0fb133ae47567e9950fc8808663 (diff) | |
msm: camera: validate num_streams in stream_cfg_cmd before using it
stream_cfg_cmd->num_streams is from userspace,
need to check it against MSM_ISP_STATS_MAX before using it.
CRs-Fixed: 2029867
Change-Id: I02a71b983947981806470454654d712bcc732077
Signed-off-by: Terence Ho <terenceh@codeaurora.org>
| -rw-r--r-- | drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c b/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c index d3ee69a14639..6e89544161ee 100644 --- a/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c +++ b/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c @@ -863,6 +863,12 @@ int msm_isp_cfg_stats_stream(struct vfe_device *vfe_dev, void *arg) if (vfe_dev->stats_data.num_active_stream == 0) vfe_dev->hw_info->vfe_ops.stats_ops.cfg_ub(vfe_dev); + if (stream_cfg_cmd->num_streams > MSM_ISP_STATS_MAX) { + pr_err("%s invalid num_streams %d\n", __func__, + stream_cfg_cmd->num_streams); + return -EINVAL; + } + if (stream_cfg_cmd->enable) { msm_isp_stats_update_cgc_override(vfe_dev, stream_cfg_cmd); |