diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-07-07 08:31:57 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-07-07 08:31:57 -0700 |
| commit | dcfc6b7782ef24b6d7b701b80a5a88792ec7c80d (patch) | |
| tree | 4911ddf3ee2a95b71617d125d450507c7498d48b | |
| parent | dec5742b2a205cbe2bc494fe6fb23e3fb369bd8b (diff) | |
| parent | 47bfda463561e672d9ea808df5bb63c9085e68f5 (diff) | |
Merge "msm: sensor: Fix to validate the settings size in flash"
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c b/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c index 491b8d31935a..cf7d1a8aa1f4 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c +++ b/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c @@ -152,6 +152,12 @@ static int32_t msm_flash_i2c_write_table( conf_array.reg_setting = settings->reg_setting_a; conf_array.size = settings->size; + /* Validate the settings size */ + if ((!conf_array.size) || (conf_array.size > MAX_I2C_REG_SET)) { + pr_err("failed: invalid size %d", conf_array.size); + return -EINVAL; + } + return flash_ctrl->flash_i2c_client.i2c_func_tbl->i2c_write_table( &flash_ctrl->flash_i2c_client, &conf_array); } |