msm: camera: Handle out of bound cases properly
In the case of seq_type, check whether the data from user
is within the bounds.
Change-Id: Ic85227c7a4fd0aabf3fffd19a79d595811a88eb2
Signed-off-by: Viswanadha Raju Thotakura <viswanad@codeaurora.org>
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
index b1698ca..ea6f902 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
@@ -340,6 +340,14 @@
}
for (i = 0; i < power_setting_size; i++) {
+
+ if (power_setting[i].seq_type < SENSOR_MCLK ||
+ power_setting[i].seq_type >= SENSOR_SEQ_TYPE_MAX) {
+ CAM_ERR(CAM_SENSOR, "failed: Invalid Seq type\n",
+ power_setting[i].seq_type);
+ return -EINVAL;
+ }
+
switch (power_setting[i].seq_type) {
case SENSOR_VDIG:
for (j = 0; j < num_vreg; j++) {
@@ -488,12 +496,8 @@
if (j == num_vreg)
power_setting[i].seq_val = INVALID_VREG;
break;
-
- default: {
- CAM_ERR(CAM_SENSOR, "invalid seq_val %d",
- power_setting[i].seq_val);
+ default:
break;
- }
}
}