Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb99c66d authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: camera: Fix memory read by adding bounds check"

parents 323ea2db 9eeca142

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+2 −1
Original line number Diff line number Diff line
@@ -1003,7 +1003,8 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev, 
	case VFE_READ_DMI_16BIT:

	case VFE_READ_DMI_32BIT:

	case VFE_READ_DMI_64BIT: {

		if (reg_cfg_cmd->cmd_type == VFE_WRITE_DMI_64BIT) {

		if (reg_cfg_cmd->cmd_type == VFE_WRITE_DMI_64BIT ||

			reg_cfg_cmd->cmd_type == VFE_READ_DMI_64BIT) {

			if ((reg_cfg_cmd->u.dmi_info.hi_tbl_offset <=

				reg_cfg_cmd->u.dmi_info.lo_tbl_offset) ||

				(reg_cfg_cmd->u.dmi_info.hi_tbl_offset -