Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e53de94 authored by Zhaohong Chen's avatar Zhaohong Chen
Browse files

msm: camera: eeprom: Fix not enough memory buffer issue in EEPROM 



Correct the limitation of memory map so that we can fully use the
allocated memory.

Change-Id: Ia844feeaa99a227e716e508a09050d56d2a47c8f
Signed-off-by: default avatarZhaohong Chen <zhaohong@codeaurora.org>
parent 0d656015

drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c

+5 −3
Original line number Diff line number Diff line
@@ -439,8 +439,8 @@ static int32_t cam_eeprom_parse_memory_map( 
	else if (cmm_hdr->cmd_type == CAMERA_SENSOR_CMD_TYPE_WAIT)

		validate_size = sizeof(struct cam_cmd_unconditional_wait);



	if (remain_buf_len < validate_size ||

	    *num_map >= MSM_EEPROM_MAX_MEM_MAP_CNT) {

	if (remain_buf_len < validate_size || *num_map >=

		(MSM_EEPROM_MEMORY_MAP_MAX_SIZE * MSM_EEPROM_MAX_MEM_MAP_CNT)) {

		CAM_ERR(CAM_EEPROM, "not enough buffer");

		return -EINVAL;

	}
@@ -449,7 +449,9 @@ static int32_t cam_eeprom_parse_memory_map( 
		i2c_random_wr = (struct cam_cmd_i2c_random_wr *)cmd_buf;



		if (i2c_random_wr->header.count == 0 ||

		    i2c_random_wr->header.count >= MSM_EEPROM_MAX_MEM_MAP_CNT ||

			i2c_random_wr->header.count >=

			(MSM_EEPROM_MEMORY_MAP_MAX_SIZE *

			MSM_EEPROM_MAX_MEM_MAP_CNT) ||

		    (size_t)*num_map > U16_MAX - i2c_random_wr->header.count) {

			CAM_ERR(CAM_EEPROM, "OOB Error");

			return -EINVAL;