Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

msm: camera: sensor: Fix use after free condition

Browse source 
Add a check to return value before calling csid config which will
otherwise lead to use after free scenario.

CRs-Fixed: 1040857
Change-Id: I4f4d9e38eeb537875e0d01de0e99913a44dd3f3f
Signed-off-by: VijayaKumar T M <vtmuni@codeaurora.org>
This commit is contained in:
VijayaKumar T M 2016-07-25 11:53:19 +05:30 committed by Flex1911
parent 00e518a71e
commit 189f24aaf2
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c
View file

@ -463,7 +463,7 @@ static long msm_csid_cmd(struct csid_device *csid_dev, void *arg)
break;
}
if (csid_params.lut_params.num_cid < 1 ||
csid_params.lut_params.num_cid > 16) {
csid_params.lut_params.num_cid > MAX_CID) {
pr_err("%s: %d num_cid outside range\n",
__func__, __LINE__);
rc = -EINVAL;
@ -493,6 +493,10 @@ static long msm_csid_cmd(struct csid_device *csid_dev, void *arg)
}
csid_params.lut_params.vc_cfg[i] = vc_cfg;
}
if (rc < 0) {
pr_err("%s:%d failed\n", __func__, __LINE__);
break;
}
rc = msm_csid_config(csid_dev, &csid_params);
for (i--; i >= 0; i--)
kfree(csid_params.lut_params.vc_cfg[i]);