diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-03-06 22:43:37 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-03-06 22:43:37 -0800 |
| commit | f3ecd0234359a8a9e64aca69e941ebb981afbcb0 (patch) | |
| tree | 1c6bc4d1740abfb581b1fea9ffe0e70ec02a0fbe | |
| parent | f35c117cc0ec07864bea85fbfaf5f9479440c4cd (diff) | |
| parent | 83c4996d36cc720c28770b08f8c4aebad63d016d (diff) | |
Merge "msm: camera: Validate size param before allocating memory"
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c b/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c index 5a891592b44f..c94ee509631f 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c +++ b/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014 - 2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -452,7 +452,8 @@ static int32_t msm_ois_config(struct msm_ois_ctrl_t *o_ctrl, break; } - if (!conf_array.size) { + if (!conf_array.size || + conf_array.size > I2C_SEQ_REG_DATA_MAX) { pr_err("%s:%d failed\n", __func__, __LINE__); rc = -EFAULT; break; |