evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: camera: isp: add bound check to handle array out of access"

Browse source
This commit is contained in:
Linux Build Service Account 2017-04-20 16:10:24 -07:00 • committed by Gerrit - the friendly Code Review server
commit ddc8181a46
2 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
View file

@ -3953,6 +3953,12 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg)
&update_cmd->req_frm_ver2;
stream_info = msm_isp_get_stream_common_data(vfe_dev,
HANDLE_TO_IDX(req_frm->stream_handle));
if (stream_info == NULL) {
pr_err_ratelimited("%s: stream_info is NULL\n",
__func__);
rc = -EINVAL;
break;
}
rc = msm_isp_request_frame(vfe_dev, stream_info,
req_frm->user_stream_id,
req_frm->frame_id,

5
drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.h
View file

@ -141,6 +141,11 @@ static inline struct msm_vfe_axi_stream *msm_isp_get_stream_common_data(
struct msm_vfe_common_dev_data *common_data = vfe_dev->common_data;
struct msm_vfe_axi_stream *stream_info;
if (stream_idx >= VFE_AXI_SRC_MAX) {
pr_err("invalid stream_idx %d\n", stream_idx);
return NULL;
}
if (vfe_dev->is_split && stream_idx < RDI_INTF_0)
stream_info = &common_data->streams[stream_idx];
else