Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 23b51487 authored by jinguiw's avatar jinguiw
Browse files

msm: camera: sensor: handling condition for random read 



Get i2c setting count twice in different location for i2c setting,
may lead to out of bound for reg settings. Record i2c setting count
in the first fetch to avoid this risk.

CRs-Fixed: 3885312
Change-Id: I2a81410fecdf41910d7d2eb0daf233621fe0b452
Signed-off-by: default avatarjinguiw <quic_jinguiw@quicinc.com>
parent 8412327d

drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c

+5 −5
Original line number Diff line number Diff line
@@ -289,10 +289,11 @@ static int32_t cam_sensor_handle_random_read( 
	struct cam_buf_io_cfg *io_cfg)

{

	struct i2c_settings_list *i2c_list;

	int32_t rc = 0, cnt = 0;

	int32_t rc = 0, cnt = 0, payload_count = 0;



	payload_count = cmd_i2c_random_rd->header.count;

	i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,

		cmd_i2c_random_rd->header.count);

		payload_count);

	if ((i2c_list == NULL) ||

		(i2c_list->i2c_settings.reg_setting == NULL)) {

		CAM_ERR(CAM_SENSOR,
@@ -307,7 +308,7 @@ static int32_t cam_sensor_handle_random_read( 
	} else {

		*cmd_length_in_bytes = sizeof(struct i2c_rdwr_header) +

			(sizeof(struct cam_cmd_read) *

			(cmd_i2c_random_rd->header.count));

			payload_count);

		i2c_list->op_code = CAM_SENSOR_I2C_READ_RANDOM;

		i2c_list->i2c_settings.addr_type =

			cmd_i2c_random_rd->header.addr_type;
@@ -316,8 +317,7 @@ static int32_t cam_sensor_handle_random_read( 
		i2c_list->i2c_settings.size =

			cmd_i2c_random_rd->header.count;



		for (cnt = 0; cnt < (cmd_i2c_random_rd->header.count);

			cnt++) {

		for (cnt = 0; cnt < payload_count; cnt++) {

			i2c_list->i2c_settings.reg_setting[cnt].reg_addr =

				cmd_i2c_random_rd->data_read[cnt].reg_data;

		}