Merge "msm: camera: jpeg: Ensure in/out map entries are within allowed range" into camera-kernel.lnx.5.0

drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c

@@ -949,11 +949,13 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv,
 		return rc;
 	}
 
-	if ((packet->num_cmd_buf > CAM_JPEG_MAX_NUM_CMD_BUFFS) || !packet->num_patches ||
-		!packet->num_io_configs) {
-		CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u",
-			packet->num_cmd_buf,
-			packet->num_patches);
+	if ((packet->num_cmd_buf > CAM_JPEG_MAX_NUM_CMD_BUFFS) ||
+		!packet->num_patches || !packet->num_io_configs ||
+		(packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) {
+		CAM_ERR(CAM_JPEG,
+			"wrong number of cmd/patch/io_configs info: %u %u %u",
+			packet->num_cmd_buf, packet->num_patches,
+			packet->num_io_configs);
 		return -EINVAL;
 	}
 

include/uapi/camera/media/cam_jpeg.h

@@ -36,6 +36,8 @@
 #define CAM_JPEG_DMA_OUTPUT_IMAGE                             0x1
 #define CAM_JPEG_DMA_IO_IMAGES_MAX                            0x2
 
+#define CAM_JPEG_IMAGE_MAX                                    0x2
+
 /*JPEG Command Buffer Metadata types*/
 #define CAM_JPEG_ENC_PACKET_CONFIG_DATA                       0x00
 #define CAM_JPEG_DMA_PACKET_PLANE0_CONFIG_DATA                0x01