samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: isp: fix potential out of bounds

Browse Source 
This change fix multiple prevent issues.
fix over bound array access, add NULL checks,
fix format specifier and fix typecasting.

CRs-Fixed: 3643117
Change-Id: I16b4405c52ae9a6c53f6ff954dc32735719a99ad
Signed-off-by: Vikram Sharma <quic_vikramsa@quicinc.com>
This commit is contained in:
Vikram Sharma
2023-10-13 16:48:02 +05:30
parent 56bb12e64b
commit 5d36106df2
5 changed files with 44 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/cam_isp/cam_isp_dev.c
View File

@@ -226,7 +226,7 @@ static int cam_isp_dev_component_bind(struct device *dev,
g_isp_dev.isp_device_type);
if (rc != 0) {
CAM_ERR(CAM_ISP, "Can not initialized ISP HW manager!");
goto kfree;
goto free_mem;
}
for (i = 0; i < g_isp_dev.max_context; i++) {
@@ -238,7 +238,7 @@ static int cam_isp_dev_component_bind(struct device *dev,
g_isp_dev.isp_device_type, iommu_hdl);
if (rc) {
CAM_ERR(CAM_ISP, "ISP context init failed!");
goto kfree;
goto free_mem;
}
}
@@ -250,7 +250,7 @@ static int cam_isp_dev_component_bind(struct device *dev,
if (rc) {
CAM_ERR(CAM_ISP, "ISP node init failed!");
goto kfree;
goto free_mem;
}
node->sd_handler = cam_isp_subdev_close_internal;
@@ -263,7 +263,7 @@ static int cam_isp_dev_component_bind(struct device *dev,
return 0;
kfree:
free_mem:
kfree(g_isp_dev.ctx);
g_isp_dev.ctx = NULL;
kfree(g_isp_dev.ctx_isp);