diff options
| -rw-r--r-- | drivers/media/i2c/ccs/ccs-data.c | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/drivers/media/i2c/ccs/ccs-data.c b/drivers/media/i2c/ccs/ccs-data.c index 59338a6704af..8444be7247b2 100644 --- a/drivers/media/i2c/ccs/ccs-data.c +++ b/drivers/media/i2c/ccs/ccs-data.c @@ -214,7 +214,7 @@ static int ccs_data_parse_regs(struct bin_container *bin, size_t *__num_regs, const void *payload, const void *endp, struct device *dev) { - struct ccs_reg *regs_base, *regs; + struct ccs_reg *regs_base = NULL, *regs = NULL; size_t num_regs = 0; u16 addr = 0; @@ -285,6 +285,9 @@ static int ccs_data_parse_regs(struct bin_container *bin, if (!bin->base) { bin_reserve(bin, len); } else if (__regs) { + if (!regs) + return -EIO; + regs->addr = addr; regs->len = len; regs->value = bin_alloc(bin, len); @@ -305,8 +308,12 @@ static int ccs_data_parse_regs(struct bin_container *bin, if (__num_regs) *__num_regs = num_regs; - if (bin->base && __regs) + if (bin->base && __regs) { + if (!regs_base) + return -EIO; + *__regs = regs_base; + } return 0; } @@ -425,7 +432,7 @@ static int ccs_data_parse_rules(struct bin_container *bin, size_t *__num_rules, const void *payload, const void *endp, struct device *dev) { - struct ccs_rule *rules_base, *rules = NULL, *next_rule; + struct ccs_rule *rules_base = NULL, *rules = NULL, *next_rule = NULL; size_t num_rules = 0; const void *__next_rule = payload; int rval; @@ -483,6 +490,9 @@ static int ccs_data_parse_rules(struct bin_container *bin, } else { unsigned int i; + if (!next_rule) + return -EIO; + rules = next_rule; next_rule++; @@ -555,6 +565,9 @@ static int ccs_data_parse_rules(struct bin_container *bin, bin_reserve(bin, sizeof(*rules) * num_rules); *__num_rules = num_rules; } else { + if (!rules_base) + return -EIO; + *__rules = rules_base; } @@ -690,7 +703,7 @@ static int ccs_data_parse_pdaf(struct bin_container *bin, struct ccs_pdaf_pix_lo } for (i = 0; i < max_block_type_id; i++) { - struct ccs_pdaf_pix_loc_pixel_desc_group *pdgroup; + struct ccs_pdaf_pix_loc_pixel_desc_group *pdgroup = NULL; unsigned int j; if (!is_contained(__num_pixel_descs, endp)) @@ -721,6 +734,9 @@ static int ccs_data_parse_pdaf(struct bin_container *bin, struct ccs_pdaf_pix_lo if (!bin->base) continue; + if (!pdgroup) + return -EIO; + pdesc = &pdgroup->descs[j]; pdesc->pixel_type = __pixel_desc->pixel_type; pdesc->small_offset_x = __pixel_desc->small_offset_x; |