msm: camera: sanitize the camera sensor driver
Check for upper bounds are added in the sensor driver and
initialized the flash driver with default value.
Change-Id: I96781d0a59404edcb0bf44609682f0344efa788d
Signed-off-by: Soundrapandian Jeyaprakash <jsoundra@codeaurora.org>
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
index b1698ca..a9c4d60 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
@@ -334,7 +334,7 @@
num_vreg = soc_info->num_rgltr;
- if (num_vreg <= 0) {
+ if ((num_vreg <= 0) || (num_vreg >= CAM_SOC_MAX_REGULATOR)) {
CAM_ERR(CAM_SENSOR, "failed: num_vreg %d", num_vreg);
return -EINVAL;
}
@@ -1132,8 +1132,8 @@
gpio_num_info = ctrl->gpio_num_info;
num_vreg = soc_info->num_rgltr;
- if ((num_vreg == 0) || (num_vreg > CAM_SOC_MAX_REGULATOR)) {
- CAM_ERR(CAM_SENSOR, "Regulators are not initialized");
+ if ((num_vreg <= 0) || (num_vreg >= CAM_SOC_MAX_REGULATOR)) {
+ CAM_ERR(CAM_SENSOR, "failed: num_vreg %d", num_vreg);
return -EINVAL;
}
@@ -1481,6 +1481,11 @@
gpio_num_info = ctrl->gpio_num_info;
num_vreg = soc_info->num_rgltr;
+ if ((num_vreg <= 0) || (num_vreg >= CAM_SOC_MAX_REGULATOR)) {
+ CAM_ERR(CAM_SENSOR, "failed: num_vreg %d", num_vreg);
+ return -EINVAL;
+ }
+
for (index = 0; index < ctrl->power_down_setting_size; index++) {
CAM_DBG(CAM_SENSOR, "index %d", index);
pd = &ctrl->power_down_setting[index];