Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6ae2412f authored by Shravya Samala's avatar Shravya Samala Committed by Sridhar Gujje
Browse files

msm: camera: jpeg: Ensure in/out map entries are within allowed range 



Added checks to make sure in_map /out_map entries of packet
io configs are within expected maximum value.

CRs-Fixed: 3007258
Change-Id: I7e5a652cd8f9ae104a10a2af551fe49930849b2d
Signed-off-by: default avatarShravya Samala <shravyas@codeaurora.org>
parent 2a8d4e15

drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c

+7 −5
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.

 */



#include <linux/uaccess.h>
@@ -728,10 +728,12 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv, 
	}



	if ((packet->num_cmd_buf > 5) || !packet->num_patches ||

		!packet->num_io_configs) {

		CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u",

			packet->num_cmd_buf,

			packet->num_patches);

		!packet->num_io_configs ||

		(packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) {

		CAM_ERR(CAM_JPEG,

			"wrong number of cmd/patch/io_configs info: %u %u %u",

			packet->num_cmd_buf, packet->num_patches,

			packet->num_io_configs);

		return -EINVAL;

	}