msm: camera: sensor: Subtract offset before validating cmd desc



Subtract command descriptor offset from buffer length obtained
from kernel before validating length of command buffer.

Change-Id: I38b244873c20894ee26b687c4bb19ef103c79363
Signed-off-by: Mukund Madhusudan Atre <matre@codeaurora.org>

parent 13371263

drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -330,6 +330,7 @@ int cam_sensor_i2c_command_parser(
		cmd_buf = (uint32_t *)generic_ptr;
		cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);

		remain_len -= cmd_desc[i].offset;
		if (remain_len < cmd_desc[i].length) {
		CAM_ERR(CAM_SENSOR, "buffer provided too small");
		return -EINVAL;