From 9dc644af5664a4cf1d07cd2419d027aa1e703b51 Mon Sep 17 00:00:00 2001 From: Terence Ho Date: Wed, 14 Jun 2017 16:05:57 -0400 Subject: [PATCH] msm: camera: validate num_streams in stream_cfg_cmd before using it stream_cfg_cmd->num_streams is from userspace, need to check it against MSM_ISP_STATS_MAX before using it. CRs-Fixed: 2029867 Change-Id: I02a71b983947981806470454654d712bcc732077 Signed-off-by: Terence Ho --- drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c b/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c index d3ee69a14639..6e89544161ee 100644 --- a/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c +++ b/drivers/media/platform/msm/ais/isp/msm_isp_stats_util.c @@ -863,6 +863,12 @@ int msm_isp_cfg_stats_stream(struct vfe_device *vfe_dev, void *arg) if (vfe_dev->stats_data.num_active_stream == 0) vfe_dev->hw_info->vfe_ops.stats_ops.cfg_ub(vfe_dev); + if (stream_cfg_cmd->num_streams > MSM_ISP_STATS_MAX) { + pr_err("%s invalid num_streams %d\n", __func__, + stream_cfg_cmd->num_streams); + return -EINVAL; + } + if (stream_cfg_cmd->enable) { msm_isp_stats_update_cgc_override(vfe_dev, stream_cfg_cmd);