A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 19:21:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: camera: sensor: handling condition for random read

Browse source 
Get i2c setting count twice in different location for i2c setting,
may lead to out of bound for reg settings. Record i2c setting count
in the first fetch to avoid this risk.

CRs-Fixed: 3885312
Change-Id: I2a81410fecdf41910d7d2eb0daf233621fe0b452
Signed-off-by: jinguiw <[email protected]>
This commit is contained in:
jinguiw 2024-07-31 15:01:07 +05:30 • committed by Prateek Pallav
commit 4bc8ff3984
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
View file

@ -395,10 +395,11 @@ static int32_t cam_sensor_handle_random_read(
struct cam_buf_io_cfg *io_cfg)
{
struct i2c_settings_list *i2c_list;
int32_t rc = 0, cnt = 0;
int32_t rc = 0, cnt = 0, payload_count = 0;
payload_count = cmd_i2c_random_rd->header.count;
i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,
cmd_i2c_random_rd->header.count);
payload_count);
if ((i2c_list == NULL) ||
(i2c_list->i2c_settings.reg_setting == NULL)) {
CAM_ERR(CAM_SENSOR,
@ -413,7 +414,7 @@ static int32_t cam_sensor_handle_random_read(
} else {
*cmd_length_in_bytes = sizeof(struct i2c_rdwr_header) +
(sizeof(struct cam_cmd_read) *
(cmd_i2c_random_rd->header.count));
payload_count);
i2c_list->op_code = CAM_SENSOR_I2C_READ_RANDOM;
i2c_list->i2c_settings.addr_type =
cmd_i2c_random_rd->header.addr_type;
@ -422,8 +423,7 @@ static int32_t cam_sensor_handle_random_read(
i2c_list->i2c_settings.size =
cmd_i2c_random_rd->header.count;
for (cnt = 0; cnt < (cmd_i2c_random_rd->header.count);
cnt++) {
for (cnt = 0; cnt < payload_count; cnt++) {
i2c_list->i2c_settings.reg_setting[cnt].reg_addr =
cmd_i2c_random_rd->data_read[cnt].reg_data;
}