Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 033fdb25 authored by Mukund Madhusudan Atre's avatar Mukund Madhusudan Atre
Browse files

msm: camera: lrme: Fix Stack Overflow condition in lrme hw manager 



Add error check for condition where array index is equal to the max
permissible io buffers for lrme which causes stack overflow.

Change-Id: Ifdf71516e5b8c269edca9965588d7e4fa0d940ff
Signed-off-by: default avatarMukund Madhusudan Atre <matre@codeaurora.org>
parent f5f31790

drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c

+12 −7
Original line number Diff line number Diff line
@@ -160,13 +160,6 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			io_cfg[i].resource_type,

			io_cfg[i].fence, io_cfg[i].format);



		if ((num_in_buf > io_buf_size) ||

			(num_out_buf > io_buf_size)) {

			CAM_ERR(CAM_LRME, "Invalid number of buffers %d %d %d",

				num_in_buf, num_out_buf, io_buf_size);

			return -EINVAL;

		}



		memset(io_addr, 0, sizeof(io_addr));

		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) {

			if (!io_cfg[i].mem_handle[plane])
@@ -194,6 +187,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 


		switch (io_cfg[i].direction) {

		case CAM_BUF_INPUT: {

			if (num_in_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->in_map_entries[num_in_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->in_map_entries[num_in_buf].sync_id =
@@ -209,6 +208,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			break;

		}

		case CAM_BUF_OUTPUT: {

			if (num_out_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->out_map_entries[num_out_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->out_map_entries[num_out_buf].sync_id =