diff options
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c b/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c index de29692414d2..cf33f64d95cd 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -196,6 +196,13 @@ static int msm_isp_prepare_v4l2_buf(struct msm_isp_buf_mgr *buf_mgr, __func__, stream_id); return -EINVAL; } + + if (qbuf_buf->num_planes > MAX_PLANES_PER_STREAM) { + pr_err("%s: Invalid num_planes %d , stream id %x\n", + __func__, qbuf_buf->num_planes, stream_id); + return -EINVAL; + } + for (i = 0; i < qbuf_buf->num_planes; i++) { mapped_info = &buf_info->mapped_info[i]; mapped_info->buf_fd = qbuf_buf->planes[i].addr; @@ -249,6 +256,12 @@ static void msm_isp_unprepare_v4l2_buf( return; } + if (buf_info->num_planes > VIDEO_MAX_PLANES) { + pr_err("%s: Invalid num_planes %d , stream id %x\n", + __func__, buf_info->num_planes, stream_id); + return; + } + bufq = msm_isp_get_bufq(buf_mgr, buf_info->bufq_handle); if (!bufq) { pr_err("%s: Invalid bufq, stream id %x\n", |