From 755261330733bb2440907a8407ed691c99451ddc Mon Sep 17 00:00:00 2001 From: Senthil Kumar Rajagopal Date: Tue, 23 May 2017 19:47:47 +0530 Subject: [PATCH] msm: camera: isp: Add bound check for an array The value of ab_ib_vote->num_src comes from userspace. This value is used as an index for accessing the array stream_src. Adding bound check to avoid accessing beyond array limit. Change-Id: I1d4555234ced24af7cd70b71ca43981fe8a3f366 Signed-off-by: Senthil Kumar Rajagopal --- drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c index f9809615b407..08a8135ea9f4 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c @@ -2480,6 +2480,12 @@ int msm_isp_ab_ib_update_lpm_mode(struct vfe_device *vfe_dev, void *arg) rc = -1; return rc; } + if (ab_ib_vote->num_src >= VFE_AXI_SRC_MAX) { + pr_err("%s: ab_ib_vote num_src is exceeding limit\n", + __func__); + rc = -1; + return rc; + } if (ab_ib_vote->lpm_mode) { for (i = 0; i < ab_ib_vote->num_src; i++) { stream_info =