Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 902aa940 authored by Petar Sivenov's avatar Petar Sivenov Committed by Gerrit - the friendly Code Review server
Browse files

msm:camera:isp: fix array index bound checks



This change fixes several incorrect or missing array index bound checks.

Change-Id: Icd96555c01330ec11e94c6173d8df1973fe39c33
Signed-off-by: default avatarPetar Sivenov <psiven@codeaurora.org>
parent 32d0ae45
Loading
Loading
Loading
Loading
+36 −20
Original line number Diff line number Diff line
@@ -368,8 +368,8 @@ int msm_isp_axi_check_stream_state(
		return -EINVAL;

	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
			MAX_NUM_STREAM) {
			return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
@@ -674,6 +674,8 @@ int msm_isp_request_axi_stream(struct vfe_device *vfe_dev, void *arg)
		&vfe_dev->axi_data, stream_cfg_cmd);
	if (rc) {
		pr_err("%s: Request validation failed\n", __func__);
		if (HANDLE_TO_IDX(stream_cfg_cmd->axi_stream_handle) <
			MAX_NUM_STREAM)
			msm_isp_axi_destroy_stream(&vfe_dev->axi_data,
			      HANDLE_TO_IDX(stream_cfg_cmd->axi_stream_handle));
		return rc;
@@ -745,11 +747,17 @@ int msm_isp_release_axi_stream(struct vfe_device *vfe_dev, void *arg)
	int rc = 0, i;
	struct msm_vfe_axi_stream_release_cmd *stream_release_cmd = arg;
	struct msm_vfe_axi_shared_data *axi_data = &vfe_dev->axi_data;
	struct msm_vfe_axi_stream *stream_info =
		&axi_data->stream_info[
		HANDLE_TO_IDX(stream_release_cmd->stream_handle)];
	struct msm_vfe_axi_stream *stream_info;
	struct msm_vfe_axi_stream_cfg_cmd stream_cfg;


	if (HANDLE_TO_IDX(stream_release_cmd->stream_handle) >=
		MAX_NUM_STREAM) {
		pr_err("%s: Invalid stream handle\n", __func__);
		return -EINVAL;
	}
	stream_info = &axi_data->stream_info[
		HANDLE_TO_IDX(stream_release_cmd->stream_handle)];
	if (stream_info->state == AVALIABLE) {
		pr_err("%s: Stream already released\n", __func__);
		return -EINVAL;
@@ -1066,6 +1074,11 @@ static void msm_isp_process_done_buf(struct vfe_device *vfe_dev,
	uint8_t drop_frame = 0;
	memset(&buf_event, 0, sizeof(buf_event));

	if (stream_idx >= MAX_NUM_STREAM) {
		pr_err("%s: Invalid stream_idx", __func__);
		return;
	}

	frame_id = vfe_dev->axi_data.
		src_info[SRC_TO_INTF(stream_info->stream_src)].frame_id;

@@ -1232,8 +1245,8 @@ static void msm_isp_update_camif_output_count(
		return;

	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
			MAX_NUM_STREAM) {
			return;
		}
		stream_info =
@@ -1532,8 +1545,8 @@ static int msm_isp_axi_update_cgc_override(struct vfe_device *vfe_dev,
		return -EINVAL;

	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
				MAX_NUM_STREAM) {
			return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
@@ -1564,8 +1577,8 @@ static int msm_isp_start_axi_stream(struct vfe_device *vfe_dev,
		return -EINVAL;

	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
			MAX_NUM_STREAM) {
			return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
@@ -1648,8 +1661,8 @@ static int msm_isp_stop_axi_stream(struct vfe_device *vfe_dev,
		return -EINVAL;

	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i])
		> MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
			MAX_NUM_STREAM) {
			return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
@@ -1913,8 +1926,8 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg)
	for (i = 0; i < update_cmd->num_streams; i++) {
		update_info = &update_cmd->update_info[i];
		/*check array reference bounds*/
		if (HANDLE_TO_IDX(update_info->stream_handle)
		 > MAX_NUM_STREAM) {
		if (HANDLE_TO_IDX(update_info->stream_handle) >=
			MAX_NUM_STREAM) {
			return -EINVAL;
		}
		stream_info = &axi_data->stream_info[
@@ -2079,7 +2092,9 @@ void msm_isp_process_axi_irq(struct vfe_device *vfe_dev,
		comp_info = &axi_data->composite_info[i];
		wm_mask &= ~(comp_info->stream_composite_mask);
		if (comp_mask & (1 << i)) {
			if (!comp_info->stream_handle) {
			stream_idx = HANDLE_TO_IDX(comp_info->stream_handle);
			if ((!comp_info->stream_handle) ||
				(stream_idx >= MAX_NUM_STREAM)) {
				pr_err("%s: Invalid handle for composite irq\n",
					__func__);
				continue;
@@ -2115,12 +2130,13 @@ void msm_isp_process_axi_irq(struct vfe_device *vfe_dev,

	for (i = 0; i < axi_data->hw_info->num_wm; i++) {
		if (wm_mask & (1 << i)) {
			if (!axi_data->free_wm[i]) {
			stream_idx = HANDLE_TO_IDX(axi_data->free_wm[i]);
			if ((!axi_data->free_wm[i]) ||
				(stream_idx >= MAX_NUM_STREAM)) {
				pr_err("%s: Invalid handle for wm irq\n",
					__func__);
				continue;
			}
			stream_idx = HANDLE_TO_IDX(axi_data->free_wm[i]);
			stream_info = &axi_data->stream_info[stream_idx];
			ISP_DBG("%s: stream id %x frame id: 0x%x\n", __func__,
				stream_info->stream_id, stream_info->frame_id);