Merge "msm: camera: isp: Handle array out of bound access." (7d1f049b) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -3812,6 +3812,11 @@ int msm_isp_update_axi_stream(struct vfe_device vfe_dev, void arg)
		case UPDATE_STREAM_REQUEST_FRAMES_VER2: {
		struct msm_vfe_axi_stream_cfg_update_info_req_frm *req_frm =
		&update_cmd->req_frm_ver2;
		if (HANDLE_TO_IDX(req_frm->stream_handle) >= VFE_AXI_SRC_MAX) {
		pr_err("%s: Invalid stream handle\n", __func__);
		rc = -EINVAL;
		break;
		}
		stream_info = &axi_data->stream_info[HANDLE_TO_IDX(
		req_frm->stream_handle)];
		rc = msm_isp_request_frame(vfe_dev, stream_info,