diff options
| author | Terence Ho <terenceh@codeaurora.org> | 2017-06-14 16:05:57 -0400 |
|---|---|---|
| committer | Andy Sun <bins@codeaurora.org> | 2017-06-21 17:12:27 +0800 |
| commit | e53f2adc3f09410a189084f21051d5f2d55c1cdf (patch) | |
| tree | c93c2065403249b051231c4a020b6ed617cd9d50 | |
| parent | 560a996da5c0bf398d2fba51e9909cd7323afea8 (diff) | |
msm: camera: validate num_streams in stream_cfg_cmd before using it
stream_cfg_cmd->num_streams is from userspace,
need to check it against MSM_ISP_STATS_MAX before using it.
CRs-Fixed: 2029867
Change-Id: I02a71b983947981806470454654d712bcc732077
Signed-off-by: Terence Ho <terenceh@codeaurora.org>
| -rw-r--r-- | drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c b/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c index 3b877b4cb994..863c2369faac 100644 --- a/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c +++ b/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c @@ -863,6 +863,12 @@ int msm_isp_cfg_stats_stream(struct vfe_device *vfe_dev, void *arg) if (vfe_dev->stats_data.num_active_stream == 0) vfe_dev->hw_info->vfe_ops.stats_ops.cfg_ub(vfe_dev); + if (stream_cfg_cmd->num_streams > MSM_ISP_STATS_MAX) { + pr_err("%s invalid num_streams %d\n", __func__, + stream_cfg_cmd->num_streams); + return -EINVAL; + } + if (stream_cfg_cmd->enable) { msm_isp_stats_update_cgc_override(vfe_dev, stream_cfg_cmd); |