Merge "msm: camera: jpeg: Ensure in/out map entries are within allowed range" into camera-kernel.lnx.4.0

drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c

@@ -761,10 +761,11 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv,
 	}
 
 	if ((packet->num_cmd_buf > 5) || !packet->num_patches ||
-		!packet->num_io_configs) {
-		CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u",
-			packet->num_cmd_buf,
-			packet->num_patches);
+		!packet->num_io_configs ||
+		(packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) {
+		CAM_ERR(CAM_JPEG,
+			"wrong number of cmd/patch/io_configs info: %u %u %u",
+			packet->num_cmd_buf, packet->num_patches, packet->num_io_configs);
 		return -EINVAL;
 	}