diff options
| author | Shravya Samala <shravyas@codeaurora.org> | 2021-09-15 12:43:33 +0530 |
|---|---|---|
| committer | timothywang <timothywang@google.com> | 2021-12-27 16:39:53 +0800 |
| commit | 11627a386c953641d34f7dfdb1b278f44bed4521 (patch) | |
| tree | 557a83445c28984b6f1fa7a755b8316938247190 | |
| parent | 60b94308066188813f27f7c0d20ea8442793ef03 (diff) | |
| download | camera-kernel-11627a386c953641d34f7dfdb1b278f44bed4521.tar.gz | |
msm: camera: jpeg: Ensure in/out map entries are within allowed range
Added checks to make sure in_map /out_map entries of packet
io configs are within expected maximum value.
Bug: 209481020
Test: build pass, local verify camera function
CRs-Fixed: 3007258
Change-Id: I941be328d0172bde47e947706f6489ea970243c7
Signed-off-by: Shravya Samala <shravyas@codeaurora.org>
Signed-off-by: timothywang <timothywang@google.com>
| -rw-r--r-- | drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c b/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c index 4d6e4a4..c27b206 100644 --- a/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c +++ b/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c @@ -728,10 +728,11 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv, } if ((packet->num_cmd_buf > 5) || !packet->num_patches || - !packet->num_io_configs) { - CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u", - packet->num_cmd_buf, - packet->num_patches); + !packet->num_io_configs || + (packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) { + CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u %u", + packet->num_cmd_buf, packet->num_patches, + packet->num_io_configs); return -EINVAL; } |