msm: ispif: fix the OOB read issue



array 'entries' indexed without any conditional check
fix this by checking index against array size.

Change-Id: Ie41890ca26d4a780d13e65ee78b7a4f51f6183ea
Signed-off-by: Srikanth Uyyala <suyyala@codeaurora.org>

parent 20e08616

drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1025,6 +1025,9 @@ static void msm_ispif_config_stereo(struct ispif_device *ispif,
		enum msm_ispif_vfe_intf vfe_intf;
		uint32_t stereo_3d_threshold = STEREO_DEFAULT_3D_THRESHOLD;

		if (params->num > MAX_PARAM_ENTRIES)
		return;

		for (i = 0; i < params->num; i++) {
		vfe_intf = params->entries[i].vfe_intf;
		if (!msm_ispif_is_intf_valid(ispif->csid_version, vfe_intf)) {