Merge "msm: camera: isp: Handle array out of bound access" (19a2db2c) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -3898,6 +3898,12 @@ int msm_isp_update_axi_stream(struct vfe_device vfe_dev, void arg)
		case UPDATE_STREAM_REQUEST_FRAMES_VER2: {
		struct msm_vfe_axi_stream_cfg_update_info_req_frm *req_frm =
		&update_cmd->req_frm_ver2;
		if (HANDLE_TO_IDX(req_frm->stream_handle) >= VFE_AXI_SRC_MAX) {
		pr_err("%s: Invalid stream handle\n", __func__);
		rc = -EINVAL;
		break;
		}

		stream_info = &axi_data->stream_info[HANDLE_TO_IDX(
		req_frm->stream_handle)];
		rc = msm_isp_request_frame(vfe_dev, stream_info,