diff --git a/drivers/cam_sensor_module/cam_ois/cam_ois_core.c b/drivers/cam_sensor_module/cam_ois/cam_ois_core.c
index aedf8059436d..cb148f775d02 100644
--- a/drivers/cam_sensor_module/cam_ois/cam_ois_core.c
+++ b/drivers/cam_sensor_module/cam_ois/cam_ois_core.c
@@ -1218,7 +1218,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
 
 				CAM_DBG(CAM_OIS, "buff_length = %d, read_length = %d", buff_length, read_length);
 
-				if (read_length > buff_length) {
+				if (read_length > buff_length || buff_length < PACKET_BYTE*MAX_PACKET) {
 					CAM_ERR(CAM_SENSOR,
 					"Invalid buffer size, readLen: %d, bufLen: %d",
 					read_length, buff_length);
diff --git a/drivers/cam_sensor_module/cam_ois/cam_ois_dev.c b/drivers/cam_sensor_module/cam_ois/cam_ois_dev.c
index 455b773b86ae..4a225bb6c499 100644
--- a/drivers/cam_sensor_module/cam_ois/cam_ois_dev.c
+++ b/drivers/cam_sensor_module/cam_ois/cam_ois_dev.c
@@ -296,9 +296,9 @@ static int cam_ois_i2c_driver_remove(struct i2c_client *client)
 static irqreturn_t cam_ois_vsync_irq_thread(int irq, void *data)
 {
 	struct cam_ois_ctrl_t *o_ctrl = data;
-	int rc = 0, handled = IRQ_NONE, packet_cnt;
+	int rc = 0, handled = IRQ_NONE, packet_cnt = 0, sample_cnt = 0;
 	uint64_t qtime_ns;
-	uint8_t *read_buff, sample_cnt;
+	uint8_t *read_buff;
 	uint32_t k, read_len;
 
 	if (!mutex_trylock(&o_ctrl->vsync_mutex)) {
@@ -332,11 +332,9 @@ static irqreturn_t cam_ois_vsync_irq_thread(int irq, void *data)
 
 	memset(o_ctrl->ois_data, 0, o_ctrl->ois_data_size);
 	read_buff = o_ctrl->ois_data;
-	packet_cnt = 0;
-	sample_cnt = 0;
 
 	do {
-		if (packet_cnt > 0)
+		if (packet_cnt > 0 && packet_cnt < MAX_PACKET)
 			read_buff += PACKET_BYTE;
 
 		// SM6375: CCI_VERSION_1_2_9 can only support read 0xE bytes data one time.
@@ -364,6 +362,13 @@ static irqreturn_t cam_ois_vsync_irq_thread(int irq, void *data)
 				if (sample_cnt != 0) {
 					packet_cnt = (sample_cnt + 9)/10;
 					CAM_DBG(CAM_OIS,"sample data = 0x%x, packet_cnt = %d", sample_cnt, packet_cnt);
+
+					// we only need max 30 sample.
+					if (packet_cnt > MAX_PACKET || sample_cnt > MAX_SAMPLE) {
+						CAM_WARN(CAM_OIS,"Too many packet, skip this read");
+						rc = -EINVAL;
+						goto release_mutex;
+					}
 				} else {
 					CAM_WARN(CAM_OIS,"No-fatal: sample data is zero, break the loop read");
 					goto release_mutex;
diff --git a/drivers/cam_sensor_module/cam_ois/cam_ois_dev.h b/drivers/cam_sensor_module/cam_ois/cam_ois_dev.h
index ace923fb978a..bb3a8df636f7 100644
--- a/drivers/cam_sensor_module/cam_ois/cam_ois_dev.h
+++ b/drivers/cam_sensor_module/cam_ois/cam_ois_dev.h
@@ -28,6 +28,7 @@
 #define PACKET_ADDR 0x70B0
 #define PACKET_BYTE 62
 #define MAX_PACKET 5
+#define MAX_SAMPLE 30
 #define READ_BYTE 0xC
 
 enum cam_ois_state {