[COMMON] fimc-is2: add validation checking for v4l2_buffer before copy them to pipe

PR JIRA ID: CPR-471

Change-Id: I25453e0135941848b5ea512f095e08ea5e9bca8e
Signed-off-by: Jeongtae Park <jtp.park@samsung.com>

diff --git a/drivers/media/platform/exynos/fimc-is2/fimc-is-video.c b/drivers/media/platform/exynos/fimc-is2/fimc-is-video.c
index fbb704eff59fed10d24e60243239d81a63698918..faa8585d6931c227ad0f5964379b691c4c2491a0 100644 (file)
--- a/drivers/media/platform/exynos/fimc-is2/fimc-is-video.c
+++ b/drivers/media/platform/exynos/fimc-is2/fimc-is-video.c
@@ -1785,6 +1785,25 @@ int fimc_is_video_prepare(struct file *file,
                        goto p_err;
                }
 
+               if (!V4L2_TYPE_IS_MULTIPLANAR(buf->type)) {
+                       mverr("the type of passed buffer is not multi-planar",
+                                       vctx, video);
+                       ret = -EINVAL;
+                       goto p_err;
+               }
+
+               if (!buf->m.planes) {
+                       mverr("planes array not provided", vctx, video);
+                       ret = -EINVAL;
+                       goto p_err;
+               }
+
+               if (buf->length > FIMC_IS_MAX_PLANES) {
+                       mverr("incorrect planes array length", vctx, video);
+                       ret = -EINVAL;
+                       goto p_err;
+               }
+
                /* Destination */
                memcpy(&pipe->buf[PIPE_SLOT_DST][index], buf, sizeof(struct v4l2_buffer));
                memcpy(pipe->planes[PIPE_SLOT_DST][index], buf->m.planes, sizeof(struct v4l2_plane) * buf->length);