diff mbox

s5p-jpeg: Fix possible NULL pointer dereference in s_fmt

Message ID 1417180218-4421-1-git-send-email-j.anaszewski@samsung.com (mailing list archive)
State New, archived
Headers show

Commit Message

Jacek Anaszewski Nov. 28, 2014, 1:10 p.m. UTC
Some formats are not supported in encoding or decoding
mode for given type of buffer (e.g. V4L2_PIX_FMT_JPEG
is supported on output buffer only while in decoding
mode). Make S_FMT failing if not suitable format
is found.

Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com>
---
 drivers/media/platform/s5p-jpeg/jpeg-core.c |    8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Hi Jacek,

On 28/11/14 14:10, Jacek Anaszewski wrote:
> Some formats are not supported in encoding or decoding
> mode for given type of buffer (e.g. V4L2_PIX_FMT_JPEG
> is supported on output buffer only while in decoding
> mode). Make S_FMT failing if not suitable format
> is found.
> 
> Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com>
> ---
>  drivers/media/platform/s5p-jpeg/jpeg-core.c |    8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
> index d7571cd..dfab848 100644
> --- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
> +++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
> @@ -1345,6 +1345,14 @@ static int s5p_jpeg_s_fmt(struct s5p_jpeg_ctx *ct, struct v4l2_format *f)
>  			FMT_TYPE_OUTPUT : FMT_TYPE_CAPTURE;
>  
>  	q_data->fmt = s5p_jpeg_find_format(ct, pix->pixelformat, f_type);
> +
> +	if (!q_data->fmt) {
> +		v4l2_err(&ct->jpeg->v4l2_dev,
> +			 "Fourcc format (0x%08x) invalid.\n",
> +			 f->fmt.pix.pixelformat);
> +		return -EINVAL;
> +	}
> +

How about forcing one of valid formats instead ? VIDIOC_S_FMT is not
supposed to return an error just because a not supported fourcc
was passed from user space.

--
Thanks,
Sylwester
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index d7571cd..dfab848 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -1345,6 +1345,14 @@  static int s5p_jpeg_s_fmt(struct s5p_jpeg_ctx *ct, struct v4l2_format *f)
 			FMT_TYPE_OUTPUT : FMT_TYPE_CAPTURE;
 
 	q_data->fmt = s5p_jpeg_find_format(ct, pix->pixelformat, f_type);
+
+	if (!q_data->fmt) {
+		v4l2_err(&ct->jpeg->v4l2_dev,
+			 "Fourcc format (0x%08x) invalid.\n",
+			 f->fmt.pix.pixelformat);
+		return -EINVAL;
+	}
+
 	q_data->w = pix->width;
 	q_data->h = pix->height;
 	if (q_data->fmt->fourcc != V4L2_PIX_FMT_JPEG) {