From b281d0d19c00a915c3f76d5d0f8df9c2a0a7119e Mon Sep 17 00:00:00 2001 From: Shravya Samala Date: Mon, 6 Sep 2021 21:12:00 +0530 Subject: [PATCH] msm: camera: jpeg: Ensure in/out map entries are within allowed range Added checks to make sure in_map /out_map entries of packet io configs are within expected maximum value. CRs-Fixed: 3007258 Change-Id: I7e5a652cd8f9ae104a10a2af551fe49930849b2d Signed-off-by: Shravya Samala --- drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c | 12 +++++++----- include/uapi/camera/media/cam_jpeg.h | 2 ++ 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c b/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c index 7627ad8198..28195413fe 100644 --- a/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c +++ b/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c @@ -943,11 +943,13 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv, return rc; } - if ((packet->num_cmd_buf > CAM_JPEG_MAX_NUM_CMD_BUFFS) || !packet->num_patches || - !packet->num_io_configs) { - CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u", - packet->num_cmd_buf, - packet->num_patches); + if ((packet->num_cmd_buf > CAM_JPEG_MAX_NUM_CMD_BUFFS) || + !packet->num_patches || !packet->num_io_configs || + (packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) { + CAM_ERR(CAM_JPEG, + "wrong number of cmd/patch/io_configs info: %u %u %u", + packet->num_cmd_buf, packet->num_patches, + packet->num_io_configs); return -EINVAL; } diff --git a/include/uapi/camera/media/cam_jpeg.h b/include/uapi/camera/media/cam_jpeg.h index 9b32e80cf6..44a2b1199b 100644 --- a/include/uapi/camera/media/cam_jpeg.h +++ b/include/uapi/camera/media/cam_jpeg.h @@ -36,6 +36,8 @@ #define CAM_JPEG_DMA_OUTPUT_IMAGE 0x1 #define CAM_JPEG_DMA_IO_IMAGES_MAX 0x2 +#define CAM_JPEG_IMAGE_MAX 0x2 + /*JPEG Command Buffer Metadata types*/ #define CAM_JPEG_ENC_PACKET_CONFIG_DATA 0x00 #define CAM_JPEG_DMA_PACKET_PLANE0_CONFIG_DATA 0x01