From 5792724f8b9b665f93406a0ac3a011e5bc9b9b12 Mon Sep 17 00:00:00 2001
From: Rajesh Bondugula <rajeshb@codeaurora.org>
Date: Wed, 13 Apr 2016 14:31:00 -0700
Subject: [PATCH] msm: camera: sensor: Validate step_boundary
step_boundary can take values upto the total_steps
Validate the step_boundary before consuming it.
Convert the type of step_index and region_index to uint16_t
step_index and region_index cannot be negative.
Bug: 27890772
CRs-Fixed: 1001092
Change-Id: I1f23fd6f28bb897824a1ef99a8873b9f986eee70
Signed-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>
---
.../msm/camera_v2/sensor/actuator/msm_actuator.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c b/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c
index 52dd5e8f8822..3339ce10e67b 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c
+++ b/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c
@@ -422,7 +422,7 @@ static int32_t msm_actuator_init_step_table(struct msm_actuator_ctrl_t *a_ctrl,
{
int16_t code_per_step = 0;
int16_t cur_code = 0;
- int16_t step_index = 0, region_index = 0;
+ uint16_t step_index = 0, region_index = 0;
uint16_t step_boundary = 0;
uint32_t max_code_size = 1;
uint16_t data_size = set_info->actuator_params.data_size;
@@ -432,6 +432,8 @@ static int32_t msm_actuator_init_step_table(struct msm_actuator_ctrl_t *a_ctrl,
max_code_size *= 2;
a_ctrl->max_code_size = max_code_size;
+
+ /* free the step_position_table to allocate a new one */
kfree(a_ctrl->step_position_table);
a_ctrl->step_position_table = NULL;
@@ -459,6 +461,15 @@ static int32_t msm_actuator_init_step_table(struct msm_actuator_ctrl_t *a_ctrl,
step_boundary =
a_ctrl->region_params[region_index].
step_bound[MOVE_NEAR];
+ if (step_boundary >
+ set_info->af_tuning_params.total_steps) {
+ pr_err("invalid step_boundary = %d, max_val = %d",
+ step_boundary,
+ set_info->af_tuning_params.total_steps);
+ kfree(a_ctrl->step_position_table);
+ a_ctrl->step_position_table = NULL;
+ return -EINVAL;
+ }
for (; step_index <= step_boundary;
step_index++) {
cur_code += code_per_step;
--
GitLab