msm: camera: isp: Handle array out of bound access (128637c5) · Commits · e / devices / android_kernel_xiaomi_markw

The index obtained from pointer req_frm can lead to indexing stream_info beyond its boundary. Therefore, a bound check has been included to avoid this. CRs-fixed: 2008683 Change-Id: I8682e09ff2ab7ba490bbbd9e20db978493c5f3e4 Signed-off-by:

Senthil Kumar Rajagopal <skrajago@codeaurora.org> Signed-off-by:

Terence Ho <terenceh@codeaurora.org> Signed-off-by:

Andy Sun <bins@codeaurora.org>

drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -3898,6 +3898,12 @@ int msm_isp_update_axi_stream(struct vfe_device vfe_dev, void arg)
		case UPDATE_STREAM_REQUEST_FRAMES_VER2: {
		struct msm_vfe_axi_stream_cfg_update_info_req_frm *req_frm =
		&update_cmd->req_frm_ver2;
		if (HANDLE_TO_IDX(req_frm->stream_handle) >= VFE_AXI_SRC_MAX) {
		pr_err("%s: Invalid stream handle\n", __func__);
		rc = -EINVAL;
		break;
		}

		stream_info = &axi_data->stream_info[HANDLE_TO_IDX(
		req_frm->stream_handle)];
		rc = msm_isp_request_frame(vfe_dev, stream_info,