Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53191cde authored by Ivan Tiyanov's avatar Ivan Tiyanov Committed by Gerrit - the friendly Code Review server
Browse files

platform: msm: sensor: Fix out of bounds and null pointer. 



This change fixes out of bounds and null pointer
dereferences in sensor drivers.

Change-Id: I5f8974d3435c2770f6e91809c153a98aa38f52a7
Signed-off-by: default avatarIvan Tiyanov <ivant@codeaurora.org>
Signed-off-by: default avatarLakshmi Narayana Kalavala <lkalaval@codeaurora.org>
parent 654c97a0

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c

+5 −0
Original line number Diff line number Diff line
@@ -149,6 +149,11 @@ int32_t msm_camera_cci_i2c_write_seq(struct msm_camera_i2c_client *client, 
	memset(reg_conf_tbl, 0,

		num_byte * sizeof(struct msm_camera_i2c_reg_array));

	reg_conf_tbl[0].reg_addr = addr;

	if (num_byte > I2C_SEQ_REG_DATA_MAX) {

		pr_err("%s: num_byte=%d clamped to max supported %d\n",

			__func__, num_byte, I2C_SEQ_REG_DATA_MAX);

		num_byte = I2C_SEQ_REG_DATA_MAX;

	}

	for (i = 0; i < num_byte; i++) {

		reg_conf_tbl[i].reg_data = data[i];

		reg_conf_tbl[i].delay = 0;

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_dt_util.c

+2 −0
Original line number Diff line number Diff line
@@ -1163,6 +1163,8 @@ power_up_failed: 
				0);

			break;

		case SENSOR_GPIO:

			if (!ctrl->gpio_conf->gpio_num_info)

				continue;

			if (!ctrl->gpio_conf->gpio_num_info->valid

				[power_setting->seq_val])

				continue;

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_qup_i2c.c

+5 −0
Original line number Diff line number Diff line
@@ -215,6 +215,11 @@ int32_t msm_camera_qup_i2c_write_seq(struct msm_camera_i2c_client *client, 
			len+1, buf[len+1]);

		len = 2;

	}

	if (num_byte > I2C_SEQ_REG_DATA_MAX) {

		pr_err("%s: num_byte=%d clamped to max supported %d\n",

			__func__, num_byte, I2C_SEQ_REG_DATA_MAX);

		num_byte = I2C_SEQ_REG_DATA_MAX;

	}

	for (i = 0; i < num_byte; i++) {

		buf[i+len] = data[i];

		S_I2C_DBG("Byte %d: 0x%x\n", i+len, buf[i+len]);

include/media/msm_cam_sensor.h

+1 −1
Original line number Diff line number Diff line
@@ -12,7 +12,7 @@ 
#endif



#define I2C_SEQ_REG_SETTING_MAX   5

#define I2C_SEQ_REG_DATA_MAX      20

#define I2C_SEQ_REG_DATA_MAX      256

#define MAX_CID                   16



#define MSM_SENSOR_MCLK_8HZ   8000000