Merge android-msm-barbet-4.19-sc-v2 into android-msm-barbet-4.19-sc-qpr3

SBMerger: 410055097
Change-Id: I6240ba278aced80054caaf0cea6864ecef4687e2
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>

drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c

diff --git a/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c b/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
index 4d6e4a4..c27b206 100644
--- a/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
+++ b/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
@@ -728,10 +728,11 @@
 	}
 
 	if ((packet->num_cmd_buf > 5) || !packet->num_patches ||
-		!packet->num_io_configs) {
-		CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u",
-			packet->num_cmd_buf,
-			packet->num_patches);
+		!packet->num_io_configs ||
+		(packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) {
+		CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u %u",
+			packet->num_cmd_buf, packet->num_patches,
+			packet->num_io_configs);
 		return -EINVAL;
 	}