From 4bc8ff3984e6accb136871b12b7017d0aa943812 Mon Sep 17 00:00:00 2001 From: jinguiw Date: Wed, 31 Jul 2024 15:01:07 +0530 Subject: [PATCH] msm: camera: sensor: handling condition for random read Get i2c setting count twice in different location for i2c setting, may lead to out of bound for reg settings. Record i2c setting count in the first fetch to avoid this risk. CRs-Fixed: 3885312 Change-Id: I2a81410fecdf41910d7d2eb0daf233621fe0b452 Signed-off-by: jinguiw --- .../cam_sensor_utils/cam_sensor_util.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c index fd423ef3da0a..325e52e6a5a2 100644 --- a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c +++ b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c @@ -395,10 +395,11 @@ static int32_t cam_sensor_handle_random_read( struct cam_buf_io_cfg *io_cfg) { struct i2c_settings_list *i2c_list; - int32_t rc = 0, cnt = 0; + int32_t rc = 0, cnt = 0, payload_count = 0; + payload_count = cmd_i2c_random_rd->header.count; i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings, - cmd_i2c_random_rd->header.count); + payload_count); if ((i2c_list == NULL) || (i2c_list->i2c_settings.reg_setting == NULL)) { CAM_ERR(CAM_SENSOR, @@ -413,7 +414,7 @@ static int32_t cam_sensor_handle_random_read( } else { *cmd_length_in_bytes = sizeof(struct i2c_rdwr_header) + (sizeof(struct cam_cmd_read) * - (cmd_i2c_random_rd->header.count)); + payload_count); i2c_list->op_code = CAM_SENSOR_I2C_READ_RANDOM; i2c_list->i2c_settings.addr_type = cmd_i2c_random_rd->header.addr_type; @@ -422,8 +423,7 @@ static int32_t cam_sensor_handle_random_read( i2c_list->i2c_settings.size = cmd_i2c_random_rd->header.count; - for (cnt = 0; cnt < (cmd_i2c_random_rd->header.count); - cnt++) { + for (cnt = 0; cnt < payload_count; cnt++) { i2c_list->i2c_settings.reg_setting[cnt].reg_addr = cmd_i2c_random_rd->data_read[cnt].reg_data; }