From patchwork Fri Oct 18 05:53:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 13841176 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9D71BD3C528 for ; Fri, 18 Oct 2024 05:58:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=VP3KFjxmL5VjFHdAxUpBaqNqhU+3Ibvdvc7de4I/pF8=; b=PlbX0OCs2AJ5UGIP2r2rruj17M 3GWy8JS0hTQh29MERXRorQSTd41Nw76JsjOFKbbTwfry3RN7csV0ANWVutrXJMSFKkMu9Mx2ofMA7 9og2ooajPrxfvNO0NjXda3R7Epr4NMglN0cJqJR8tHZSmAO+5t5ElkvcQuuqHK+GldVJZUAvWIpgh rgsOCC+DMqhyLmDYR3JiiRc7Fa5ndAkU5JwY7+fJsptL1uLhR+poV2fQsQmHlsyZCk6OxU/+yfLEJ VSSOnQluslaKk9VG+SMfdJ5gkhdfvghRCrYUCWpujci8Oaxo1yiTnz3f6yufP/X/pOL5covthTjhV hOwbqvqg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1t1g0Q-0000000H3oU-3MUz; Fri, 18 Oct 2024 05:58:34 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1t1fvU-0000000H1t1-0nL1 for linux-arm-kernel@lists.infradead.org; Fri, 18 Oct 2024 05:53:31 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 1EEF15C5CD9; Fri, 18 Oct 2024 05:53:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6F92C4CED1; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=wVXSfTdlzHbzFNnkVyQi+BQqJKzdBu2IARFn0RCaO+M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rcKa8wDUnwuY0FJLrBxIUAGN44E/2NnZ8QzxgE9pfKxNX4Xuof00SUbx2CQeqlDan /wzOt+/tae2mSufNC8k0DATXp1O8oS2PDiNErWX2dNKhnlVaydX9cb5+RLZMx0mncS 67Jc+9ErK3C7ycsuH0VMell/QtaFRBVXIsqnUI+0J+O41mBqxK24rE6xzrmAMd8Cm6 zQt2CbfnZ8pSYP9slekMPX7+gPo+8RJAoqXcSGhAe6bysAvY9O1rCOPBxEud/Y/lm1 3rYHGjceh2E+v3ESEC7YJdTGlI6vx4AGaIeelBXpJNv0ebOzjTrMrdOs4tWVpSQAN1 N1O2YYH/EwDsg== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005MeL-1uTx; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Andrzej Pietrasiewicz , Hans Verkuil , Jacek Anaszewski , Mauro Carvalho Chehab , Sylwester Nawrocki , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 07/13] media: s5p-jpeg: prevent buffer overflows Date: Fri, 18 Oct 2024 07:53:09 +0200 Message-ID: <172461a2e8b2a1a4f01add73afae777463ea0fb8.1729230718.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20241017_225328_471355_3BA21C8A X-CRM114-Status: GOOD ( 15.21 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it. While here, remove an unused word = 0 assignment. Fixes: 6c96dbbc2aa9 ("[media] s5p-jpeg: add support for 5433") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Jacek Anaszewski --- .../media/platform/samsung/s5p-jpeg/jpeg-core.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c b/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c index d2c4a0178b3c..1db4609b3557 100644 --- a/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c +++ b/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c @@ -775,11 +775,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; jpeg_buffer.curr = 0; - word = 0; - if (get_word_be(&jpeg_buffer, &word)) return; - jpeg_buffer.size = (long)word - 2; + + if (word < 2) + jpeg_buffer.size = 0; + else + jpeg_buffer.size = (long)word - 2; + jpeg_buffer.data += 2; jpeg_buffer.curr = 0; @@ -1058,6 +1061,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, unsigned int *word) if (byte == -1) return -1; *word = (unsigned int)byte | temp; + return 0; } @@ -1145,7 +1149,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; sof = jpeg_buffer.curr; /* after 0xffc0 */ sof_len = length; @@ -1176,7 +1180,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dqt >= S5P_JPEG_MAX_MARKER) return false; @@ -1189,7 +1193,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dht >= S5P_JPEG_MAX_MARKER) return false; @@ -1214,6 +1218,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; + /* No need to check underflows as skip() does it */ skip(&jpeg_buffer, length); break; }