diff --git a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c
index df95e5cb9b99..094a7861831a 100644
--- a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c
+++ b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c
@@ -840,7 +840,7 @@ static uint16_t msm_ispif_get_cids_mask_from_cfg(
 	uint16_t cids_mask = 0;
 	BUG_ON(!entry);
 
-	for (i = 0; i < entry->num_cids; i++)
+	for (i = 0; i < entry->num_cids && i < MAX_CID_CH_PARAM_ENTRY; i++)
 		cids_mask |= (1 << entry->cids[i]);
 
 	return cids_mask;
@@ -970,7 +970,7 @@ static void msm_ispif_intf_cmd(struct ispif_device *ispif, uint32_t cmd_bits,
 			pr_err("%s: invalid interface type\n", __func__);
 			return;
 		}
-		if (params->entries[i].num_cids > MAX_CID_CH) {
+		if (params->entries[i].num_cids > MAX_CID_CH_PARAM_ENTRY) {
 			pr_err("%s: out of range of cid_num %d\n",
 				__func__, params->entries[i].num_cids);
 			return;
diff --git a/include/uapi/media/msmb_ispif.h b/include/uapi/media/msmb_ispif.h
index 7f4deaf12683..3720056aa28d 100644
--- a/include/uapi/media/msmb_ispif.h
+++ b/include/uapi/media/msmb_ispif.h
@@ -28,6 +28,7 @@ enum msm_ispif_intftype {
 };
 #define MAX_PARAM_ENTRIES (INTF_MAX * 2)
 #define MAX_CID_CH	8
+#define MAX_CID_CH_PARAM_ENTRY	3
 
 #define PIX0_MASK (1 << PIX0)
 #define PIX1_MASK (1 << PIX1)
@@ -94,7 +95,7 @@ struct msm_ispif_params_entry {
 	enum msm_ispif_vfe_intf vfe_intf;
 	enum msm_ispif_intftype intftype;
 	int num_cids;
-	enum msm_ispif_cid cids[3];
+	enum msm_ispif_cid cids[MAX_CID_CH_PARAM_ENTRY];
 	enum msm_ispif_csid csid;
 	int crop_enable;
 	uint16_t crop_start_pixel;