evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: isp: Handle array out of bound access

Browse source 
The index obtained from pointer req_frm can lead to indexing
stream_info beyond its boundary. Therefore, a bound check has been
included to avoid this.

CRs-fixed: 2008683
Change-Id: I8682e09ff2ab7ba490bbbd9e20db978493c5f3e4
Signed-off-by: Senthil Kumar Rajagopal <skrajago@codeaurora.org>
Signed-off-by: Terence Ho <terenceh@codeaurora.org>
Signed-off-by: Andy Sun <bins@codeaurora.org>
This commit is contained in:
Sriraj Hebbar 2017-06-30 13:14:28 +05:30 • committed by Gerrit - the friendly Code Review server
parent 0530e3fe60
commit 9e50d6c84d
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c
View file

@ -3889,6 +3889,12 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg)
case UPDATE_STREAM_REQUEST_FRAMES_VER2: {
struct msm_vfe_axi_stream_cfg_update_info_req_frm *req_frm =
&update_cmd->req_frm_ver2;
if (HANDLE_TO_IDX(req_frm->stream_handle) >= VFE_AXI_SRC_MAX) {
pr_err("%s: Invalid stream handle\n", __func__);
rc = -EINVAL;
break;
}
stream_info = &axi_data->stream_info[HANDLE_TO_IDX(
req_frm->stream_handle)];
rc = msm_isp_request_frame(vfe_dev, stream_info,