From 25eeb3a3b2a3b35bd6a2fd12d4a0dcc4ef1ac1b5 Mon Sep 17 00:00:00 2001 From: Venu Yeshala Date: Mon, 5 Jun 2017 10:55:00 +0530 Subject: [PATCH] msm: isp: camera: Avoid potential out of bound write Check the validity of VFE interface parameter that is provided from userspace. Change-Id: I0ebb95c824ab3f832aaf500a6655829cca846c3d Signed-off-by: Venu Yeshala --- drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c index 24e3223a79d0..2bd6203feee4 100644 --- a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c +++ b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c @@ -1021,6 +1021,11 @@ static void msm_ispif_config_stereo(struct ispif_device *ispif, for (i = 0; i < params->num; i++) { vfe_intf = params->entries[i].vfe_intf; + if (!msm_ispif_is_intf_valid(ispif->csid_version, vfe_intf)) { + pr_err("%s: invalid interface type %d\n", __func__, + vfe_intf); + return; + } if (params->entries[i].intftype == PIX0 && params->stereo_enable && params->right_entries[i].csid < CSID_MAX &&