diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-03-01 02:22:43 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-03-01 02:22:42 -0800 |
| commit | 4b2c57e721c89fecca012e37c6780215990be867 (patch) | |
| tree | afca22c0c68dda08cd7008ae767e7930f35f42e1 | |
| parent | eee829e625416a38a8066524a0f6cac3b0c9d55b (diff) | |
| parent | a452045792bc09548b4e1b940aa8adfed822b51c (diff) | |
Merge "msm: camera: isp: Handle array out of bounds"
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c b/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c index f7eb0f8ac5a8..8d66232dbda1 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c @@ -196,6 +196,13 @@ static int msm_isp_prepare_v4l2_buf(struct msm_isp_buf_mgr *buf_mgr, __func__, stream_id); return -EINVAL; } + + if (qbuf_buf->num_planes > MAX_PLANES_PER_STREAM) { + pr_err("%s: Invalid num_planes %d , stream id %x\n", + __func__, qbuf_buf->num_planes, stream_id); + return -EINVAL; + } + for (i = 0; i < qbuf_buf->num_planes; i++) { mapped_info = &buf_info->mapped_info[i]; mapped_info->buf_fd = qbuf_buf->planes[i].addr; @@ -249,6 +256,12 @@ static void msm_isp_unprepare_v4l2_buf( return; } + if (buf_info->num_planes > VIDEO_MAX_PLANES) { + pr_err("%s: Invalid num_planes %d , stream id %x\n", + __func__, buf_info->num_planes, stream_id); + return; + } + bufq = msm_isp_get_bufq(buf_mgr, buf_info->bufq_handle); if (!bufq) { pr_err("%s: Invalid bufq, stream id %x\n", |