diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-07-27 06:47:06 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-07-27 06:47:06 -0700 |
| commit | ac8211566ba58dd2be22c399f559a44a09054bf4 (patch) | |
| tree | d0702379090bede66408d9a52c2d64618f0d1f93 | |
| parent | 08a5bd86c1bad3769f60d4e7d9cf363213c0921c (diff) | |
| parent | b2e834cfe133f83b38627e6320be858ff2559137 (diff) | |
Merge "msm: ispif: fix the OOB read issue"
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c index 3f900ded090a..9c3bd7b41ce9 100644 --- a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c +++ b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c @@ -1025,6 +1025,9 @@ static void msm_ispif_config_stereo(struct ispif_device *ispif, enum msm_ispif_vfe_intf vfe_intf; uint32_t stereo_3d_threshold = STEREO_DEFAULT_3D_THRESHOLD; + if (params->num > MAX_PARAM_ENTRIES) + return; + for (i = 0; i < params->num; i++) { vfe_intf = params->entries[i].vfe_intf; if (!msm_ispif_is_intf_valid(ispif->csid_version, vfe_intf)) { |