aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlok Kediya <kediya@codeaurora.org>2013-12-09 05:22:49 (GMT)
committerGerrit - the friendly Code Review server <code-review@localhost>2013-12-12 11:48:04 (GMT)
commit7beb04ea945a7178e61d935918d3cb152996b558 (patch)
tree31eee39302cf47d7e7e54bbecd41a5f7d709ad1a
parent384d474eeb86a507e357a7856ffd4bce4d5765c4 (diff)
msm: camera: Added bounds check for index parameter
Bound check the index param from user space to avoid any invalid memory access. CRs-Fixed: 583366 Change-Id: I0f887bb8f1fa5a69a55e23dbb522b3bb694ad27f Signed-off-by: Alok Kediya <kediya@codeaurora.org>
-rw-r--r--drivers/media/video/msm/server/msm_cam_server.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/media/video/msm/server/msm_cam_server.c b/drivers/media/video/msm/server/msm_cam_server.c
index 5fc8e83..6e49082 100644
--- a/drivers/media/video/msm/server/msm_cam_server.c
+++ b/drivers/media/video/msm/server/msm_cam_server.c
@@ -1390,6 +1390,15 @@ static long msm_ioctl_server(struct file *file, void *fh,
}
mutex_lock(&g_server_dev.server_queue_lock);
+
+ if(u_isp_event.isp_data.ctrl.queue_idx < 0 ||
+ u_isp_event.isp_data.ctrl.queue_idx >= MAX_NUM_ACTIVE_CAMERA) {
+ pr_err("%s: Invalid index %d\n", __func__,
+ u_isp_event.isp_data.ctrl.queue_idx);
+ rc = -EINVAL;
+ return rc;
+ }
+
if (!g_server_dev.server_queue
[u_isp_event.isp_data.ctrl.queue_idx].queue_active) {
pr_err("%s: Invalid queue\n", __func__);