diff --git a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c index 190d4808ffd90..ec42af0ed45a0 100644 --- a/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c +++ b/drivers/staging/vc04_services/vchiq-mmal/mmal-vchiq.c @@ -478,12 +478,19 @@ static void event_to_host_cb(struct vchiq_mmal_instance *instance, struct mmal_msg *msg, u32 msg_len) { int comp_idx = msg->u.event_to_host.client_component; - struct vchiq_mmal_component *component = - &instance->component[comp_idx]; + struct vchiq_mmal_component *component; struct vchiq_mmal_port *port = NULL; struct mmal_msg_context *msg_context; u32 port_num = msg->u.event_to_host.port_num; + if (comp_idx < 0 || comp_idx >= VCHIQ_MMAL_MAX_COMPONENTS) { + pr_err_ratelimited("%s: component index %d out of range\n", + __func__, comp_idx); + return; + } + + component = &instance->component[comp_idx]; + if (msg->u.buffer_from_host.drvbuf.magic == MMAL_MAGIC) { pr_err("%s: MMAL_MSG_TYPE_BUFFER_TO_HOST with bad magic\n", __func__);