Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 902aa940 authored by Petar Sivenov's avatar Petar Sivenov Committed by Gerrit - the friendly Code Review server
Browse files

msm:camera:isp: fix array index bound checks 



This change fixes several incorrect or missing array index bound checks.

Change-Id: Icd96555c01330ec11e94c6173d8df1973fe39c33
Signed-off-by: default avatarPetar Sivenov <psiven@codeaurora.org>
parent 32d0ae45

drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c

+36 −20
Original line number Diff line number Diff line
@@ -368,8 +368,8 @@ int msm_isp_axi_check_stream_state( 
		return -EINVAL;



	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {

		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])

		> MAX_NUM_STREAM) {

		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=

			MAX_NUM_STREAM) {

			return -EINVAL;

		}

		stream_info = &axi_data->stream_info[
@@ -674,6 +674,8 @@ int msm_isp_request_axi_stream(struct vfe_device *vfe_dev, void *arg) 
		&vfe_dev->axi_data, stream_cfg_cmd);

	if (rc) {

		pr_err("%s: Request validation failed\n", __func__);

		if (HANDLE_TO_IDX(stream_cfg_cmd->axi_stream_handle) <

			MAX_NUM_STREAM)

			msm_isp_axi_destroy_stream(&vfe_dev->axi_data,

			      HANDLE_TO_IDX(stream_cfg_cmd->axi_stream_handle));

		return rc;
@@ -745,11 +747,17 @@ int msm_isp_release_axi_stream(struct vfe_device *vfe_dev, void *arg) 
	int rc = 0, i;

	struct msm_vfe_axi_stream_release_cmd *stream_release_cmd = arg;

	struct msm_vfe_axi_shared_data *axi_data = &vfe_dev->axi_data;

	struct msm_vfe_axi_stream *stream_info =

		&axi_data->stream_info[

		HANDLE_TO_IDX(stream_release_cmd->stream_handle)];

	struct msm_vfe_axi_stream *stream_info;

	struct msm_vfe_axi_stream_cfg_cmd stream_cfg;





	if (HANDLE_TO_IDX(stream_release_cmd->stream_handle) >=

		MAX_NUM_STREAM) {

		pr_err("%s: Invalid stream handle\n", __func__);

		return -EINVAL;

	}

	stream_info = &axi_data->stream_info[

		HANDLE_TO_IDX(stream_release_cmd->stream_handle)];

	if (stream_info->state == AVALIABLE) {

		pr_err("%s: Stream already released\n", __func__);

		return -EINVAL;
@@ -1066,6 +1074,11 @@ static void msm_isp_process_done_buf(struct vfe_device *vfe_dev, 
	uint8_t drop_frame = 0;

	memset(&buf_event, 0, sizeof(buf_event));



	if (stream_idx >= MAX_NUM_STREAM) {

		pr_err("%s: Invalid stream_idx", __func__);

		return;

	}



	frame_id = vfe_dev->axi_data.

		src_info[SRC_TO_INTF(stream_info->stream_src)].frame_id;
@@ -1232,8 +1245,8 @@ static void msm_isp_update_camif_output_count( 
		return;



	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {

		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])

		> MAX_NUM_STREAM) {

		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=

			MAX_NUM_STREAM) {

			return;

		}

		stream_info =
@@ -1532,8 +1545,8 @@ static int msm_isp_axi_update_cgc_override(struct vfe_device *vfe_dev, 
		return -EINVAL;



	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {

		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])

		> MAX_NUM_STREAM) {

		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=

				MAX_NUM_STREAM) {

			return -EINVAL;

		}

		stream_info = &axi_data->stream_info[
@@ -1564,8 +1577,8 @@ static int msm_isp_start_axi_stream(struct vfe_device *vfe_dev, 
		return -EINVAL;



	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {

		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])

		> MAX_NUM_STREAM) {

		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=

			MAX_NUM_STREAM) {

			return -EINVAL;

		}

		stream_info = &axi_data->stream_info[
@@ -1648,8 +1661,8 @@ static int msm_isp_stop_axi_stream(struct vfe_device *vfe_dev, 
		return -EINVAL;



	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {

		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])

		> MAX_NUM_STREAM) {

		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=

			MAX_NUM_STREAM) {

			return -EINVAL;

		}

		stream_info = &axi_data->stream_info[
@@ -1913,8 +1926,8 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg) 
	for (i = 0; i < update_cmd->num_streams; i++) {

		update_info = &update_cmd->update_info[i];

		/*check array reference bounds*/

		if (HANDLE_TO_IDX(update_info->stream_handle)

		 > MAX_NUM_STREAM) {

		if (HANDLE_TO_IDX(update_info->stream_handle) >=

			MAX_NUM_STREAM) {

			return -EINVAL;

		}

		stream_info = &axi_data->stream_info[
@@ -2079,7 +2092,9 @@ void msm_isp_process_axi_irq(struct vfe_device *vfe_dev, 
		comp_info = &axi_data->composite_info[i];

		wm_mask &= ~(comp_info->stream_composite_mask);

		if (comp_mask & (1 << i)) {

			if (!comp_info->stream_handle) {

			stream_idx = HANDLE_TO_IDX(comp_info->stream_handle);

			if ((!comp_info->stream_handle) ||

				(stream_idx >= MAX_NUM_STREAM)) {

				pr_err("%s: Invalid handle for composite irq\n",

					__func__);

				continue;
@@ -2115,12 +2130,13 @@ void msm_isp_process_axi_irq(struct vfe_device *vfe_dev, 


	for (i = 0; i < axi_data->hw_info->num_wm; i++) {

		if (wm_mask & (1 << i)) {

			if (!axi_data->free_wm[i]) {

			stream_idx = HANDLE_TO_IDX(axi_data->free_wm[i]);

			if ((!axi_data->free_wm[i]) ||

				(stream_idx >= MAX_NUM_STREAM)) {

				pr_err("%s: Invalid handle for wm irq\n",

					__func__);

				continue;

			}

			stream_idx = HANDLE_TO_IDX(axi_data->free_wm[i]);

			stream_info = &axi_data->stream_info[stream_idx];

			ISP_DBG("%s: stream id %x frame id: 0x%x\n", __func__,

				stream_info->stream_id, stream_info->frame_id);