A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 13:49:24 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: camera: jpeg: Ensure in/out map entries are within allowed range

Browse source 
Added checks to make sure in_map /out_map entries of packet
io configs are within expected maximum value.

CRs-Fixed: 3007258
Change-Id: I7e5a652cd8f9ae104a10a2af551fe49930849b2d
Signed-off-by: Shravya Samala <shravyas@codeaurora.org>
This commit is contained in:
Shravya Samala 2021-09-06 21:12:00 +05:30
commit ed7d45ddc5
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
View file

@ -743,10 +743,11 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv,
}
if ((packet->num_cmd_buf > 5) || !packet->num_patches ||
!packet->num_io_configs) {
CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u",
packet->num_cmd_buf,
packet->num_patches);
!packet->num_io_configs ||
(packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) {
CAM_ERR(CAM_JPEG,
"wrong number of cmd/patch/io_configs info: %u %u %u",
packet->num_cmd_buf, packet->num_patches, packet->num_io_configs);
return -EINVAL;
}