diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-03-06 22:43:34 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-03-06 22:43:33 -0800 |
| commit | 84d7cb53a5a738edb22873c8fd49d3ac0d173571 (patch) | |
| tree | fc14337ef259cee6948d4417e412b6f34f46c299 /drivers | |
| parent | 1cb56eedff6923771ac335e8a736174055fca814 (diff) | |
| parent | 9fa25bf455f815a748bb518d300e84e1560bdf23 (diff) | |
Merge "msm: isp: fix for potentitial array out of bound access"
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c index df9691be0c28..fb3a962d15ca 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c @@ -630,6 +630,13 @@ static int msm_isp_set_dual_HW_master_slave_mode( } ISP_DBG("%s: vfe %d num_src %d\n", __func__, vfe_dev->pdev->id, dual_hw_ms_cmd->num_src); + if (dual_hw_ms_cmd->num_src > VFE_SRC_MAX) { + pr_err("%s: Error! Invalid num_src %d\n", __func__, + dual_hw_ms_cmd->num_src); + spin_unlock_irqrestore(&vfe_dev->common_data-> + common_dev_data_lock, flags); + return -EINVAL; + } /* This for loop is for non-primary intf to be marked with Master/Slave * in order for frame id sync. But their timestamp is not saved. * So no sof_info resource is allocated */ |