From 83c4996d36cc720c28770b08f8c4aebad63d016d Mon Sep 17 00:00:00 2001 From: VijayaKumar T M Date: Mon, 13 Feb 2017 18:11:17 +0530 Subject: [PATCH] msm: camera: Validate size param before allocating memory Whenever i2c write is initiated check size param for NULL. In case of i2c sequence write, check for maximum allowed size per sequence write. CRs-Fixed: 779253 Change-Id: Ib9fa1d620e888ba8410b241d08895af993b6d960 Signed-off-by: VijayaKumar T M Signed-off-by: Ravi Kishore Tanuku --- drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c b/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c index 5a891592b44f..c94ee509631f 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c +++ b/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014 - 2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -452,7 +452,8 @@ static int32_t msm_ois_config(struct msm_ois_ctrl_t *o_ctrl, break; } - if (!conf_array.size) { + if (!conf_array.size || + conf_array.size > I2C_SEQ_REG_DATA_MAX) { pr_err("%s:%d failed\n", __func__, __LINE__); rc = -EFAULT; break;