From a96e06fac09e182b5211f20dd6311f93a5d056af Mon Sep 17 00:00:00 2001 From: Senthil Kumar Rajagopal Date: Mon, 10 Apr 2017 16:53:33 +0530 Subject: [PATCH] msm: camera: isp: Initialize stream info Initialize the Stream info before passing as an argument to msm_isp_request_frame and add bound check to the stream index CRs-fixed: 2008683 Bug: 64453533 Change-Id: I0039a5d01f4f376060c8b0ba3baf4ce55acc9446 Signed-off-by: Senthil Kumar Rajagopal --- drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c index 5e0b685aec801..54ab560f09137 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -3488,6 +3488,14 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg) case UPDATE_STREAM_REQUEST_FRAMES_VER2: { struct msm_vfe_axi_stream_cfg_update_info_req_frm *req_frm = &update_cmd->req_frm_ver2; + if (HANDLE_TO_IDX(req_frm->stream_handle) >= VFE_AXI_SRC_MAX) { + pr_err("%s: Invalid stream handle \n", __func__); + rc = -EINVAL; + break; + } + stream_info = &axi_data->stream_info[HANDLE_TO_IDX( + req_frm->stream_handle)]; + rc = msm_isp_request_frame(vfe_dev, stream_info, req_frm->user_stream_id, req_frm->frame_id,