| Message ID | 1381997754-3348-1-git-send-email-sakari.ailus@linux.intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Hi Sakari, On 10/17/2013 10:15 AM, Sakari Ailus wrote: > The validity of the pad field in struct v4l2_subdev_frame_interval was not > ensured by the V4L2 subdev IOCTL helper. Fix this. > > Signed-off-by: Sakari Ailus<sakari.ailus@linux.intel.com> Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Regards, Sylwester > --- > drivers/media/v4l2-core/v4l2-subdev.c | 16 ++++++++++++++-- > 1 file changed, 14 insertions(+), 2 deletions(-) > > diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c > index 996c248..3fa1907 100644 > --- a/drivers/media/v4l2-core/v4l2-subdev.c > +++ b/drivers/media/v4l2-core/v4l2-subdev.c > @@ -305,11 +305,23 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg) > fse); > } > > - case VIDIOC_SUBDEV_G_FRAME_INTERVAL: > + case VIDIOC_SUBDEV_G_FRAME_INTERVAL: { > + struct v4l2_subdev_frame_interval *fi = arg; > + > + if (fi->pad>= sd->entity.num_pads) > + return -EINVAL; > + > return v4l2_subdev_call(sd, video, g_frame_interval, arg); > + } > + > + case VIDIOC_SUBDEV_S_FRAME_INTERVAL: { > + struct v4l2_subdev_frame_interval *fi = arg; > + > + if (fi->pad>= sd->entity.num_pads) > + return -EINVAL; > > - case VIDIOC_SUBDEV_S_FRAME_INTERVAL: > return v4l2_subdev_call(sd, video, s_frame_interval, arg); > + } > > case VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL: { > struct v4l2_subdev_frame_interval_enum *fie = arg; -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c index 996c248..3fa1907 100644 --- a/drivers/media/v4l2-core/v4l2-subdev.c +++ b/drivers/media/v4l2-core/v4l2-subdev.c @@ -305,11 +305,23 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg) fse); } - case VIDIOC_SUBDEV_G_FRAME_INTERVAL: + case VIDIOC_SUBDEV_G_FRAME_INTERVAL: { + struct v4l2_subdev_frame_interval *fi = arg; + + if (fi->pad >= sd->entity.num_pads) + return -EINVAL; + return v4l2_subdev_call(sd, video, g_frame_interval, arg); + } + + case VIDIOC_SUBDEV_S_FRAME_INTERVAL: { + struct v4l2_subdev_frame_interval *fi = arg; + + if (fi->pad >= sd->entity.num_pads) + return -EINVAL; - case VIDIOC_SUBDEV_S_FRAME_INTERVAL: return v4l2_subdev_call(sd, video, s_frame_interval, arg); + } case VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL: { struct v4l2_subdev_frame_interval_enum *fie = arg;
The validity of the pad field in struct v4l2_subdev_frame_interval was not ensured by the V4L2 subdev IOCTL helper. Fix this. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> --- drivers/media/v4l2-core/v4l2-subdev.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)