samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: csid: Check upper bound for cid index

Browse Source 
Add check to restrict upper bound on cid_data array.

CRs-Fixed: 3874372
Change-Id: I471ce943a012ec423ac28df4ea0c0e901f75f4cf
Signed-off-by: Pranav Sanwal <quic_psanwal@quicinc.com>
(cherry picked from commit cd41b5384f5fe6da52eb8c638fd183032a5a9365)
This commit is contained in:
Pranav Sanwal
2024-07-19 15:37:53 +05:30
committed by Bharat Bommena
parent 50bc1b3fa8
commit e28c84a699
2 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver1.c
View File

@@ -1821,6 +1821,14 @@ int cam_ife_csid_ver1_release(void *hw_priv,
csid_hw->hw_intf->hw_idx, res->res_type, res->res_id); csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
path_cfg = (struct cam_ife_csid_ver1_path_cfg *)res->res_priv; path_cfg = (struct cam_ife_csid_ver1_path_cfg *)res->res_priv;
if (path_cfg->cid >= CAM_IFE_CSID_CID_MAX) {
CAM_ERR(CAM_ISP, "CSID:%d Invalid cid:%d",
csid_hw->hw_intf->hw_idx, path_cfg->cid);
rc = -EINVAL;
goto end;
}
cam_ife_csid_cid_release(&csid_hw->cid_data[path_cfg->cid], cam_ife_csid_cid_release(&csid_hw->cid_data[path_cfg->cid],
csid_hw->hw_intf->hw_idx, csid_hw->hw_intf->hw_idx,
path_cfg->cid); path_cfg->cid);

7
drivers/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_hw_ver2.c
View File

@@ -3506,6 +3506,13 @@ int cam_ife_csid_ver2_release(void *hw_priv,
path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv; path_cfg = (struct cam_ife_csid_ver2_path_cfg *)res->res_priv;
if (path_cfg->cid >= CAM_IFE_CSID_CID_MAX) {
CAM_ERR(CAM_ISP, "CSID:%d Invalid cid:%d",
csid_hw->hw_intf->hw_idx, path_cfg->cid);
rc = -EINVAL;
goto end;
}
cam_ife_csid_cid_release(&csid_hw->cid_data[path_cfg->cid], cam_ife_csid_cid_release(&csid_hw->cid_data[path_cfg->cid],
csid_hw->hw_intf->hw_idx, csid_hw->hw_intf->hw_idx,
path_cfg->cid); path_cfg->cid);