From patchwork Fri Nov 28 13:10:18 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jacek Anaszewski X-Patchwork-Id: 5403261 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 4DB67BEEA8 for ; Fri, 28 Nov 2014 13:10:38 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 8C46C20149 for ; Fri, 28 Nov 2014 13:10:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6B885201C0 for ; Fri, 28 Nov 2014 13:10:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751142AbaK1NKd (ORCPT ); Fri, 28 Nov 2014 08:10:33 -0500 Received: from mailout3.samsung.com ([203.254.224.33]:15456 "EHLO mailout3.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751057AbaK1NKc (ORCPT ); Fri, 28 Nov 2014 08:10:32 -0500 Received: from epcpsbgm2.samsung.com (epcpsbgm2 [203.254.230.27]) by mailout3.samsung.com (Oracle Communications Messaging Server 7u4-24.01(7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTP id <0NFR00FB139H9D80@mailout3.samsung.com> for linux-media@vger.kernel.org; Fri, 28 Nov 2014 22:10:29 +0900 (KST) X-AuditID: cbfee61b-f79d76d0000024d6-da-54787445fe2b Received: from epmmp2 ( [203.254.227.17]) by epcpsbgm2.samsung.com (EPCPMTA) with SMTP id 22.36.09430.54478745; Fri, 28 Nov 2014 22:10:29 +0900 (KST) Received: from AMDC2362.DIGITAL.local ([106.120.53.23]) by mmp2.samsung.com (Oracle Communications Messaging Server 7u4-24.01 (7.0.4.24.0) 64bit (built Nov 17 2011)) with ESMTPA id <0NFR0046A3987PB0@mmp2.samsung.com>; Fri, 28 Nov 2014 22:10:29 +0900 (KST) From: Jacek Anaszewski To: linux-media@vger.kernel.org Cc: s.nawrocki@samsung.com, Jacek Anaszewski Subject: [PATCH] s5p-jpeg: Fix possible NULL pointer dereference in s_fmt Date: Fri, 28 Nov 2014 14:10:18 +0100 Message-id: <1417180218-4421-1-git-send-email-j.anaszewski@samsung.com> X-Mailer: git-send-email 1.7.9.5 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrOJMWRmVeSWpSXmKPExsVy+t9jQV3XkooQg/aTZha9V58zWvRs2Mpq cfhNO6sDs0ffllWMHp83yQUwRXHZpKTmZJalFunbJXBldC07x1LwmKNiyqmLjA2MG9m7GDk4 JARMJI5NTehi5AQyxSQu3FvP1sXIxSEkMJ1R4kT3Y2YIp51JYuLuKewgVWwChhI/X7xmArFF BOQlnvTeYAOxmQXcJda2TGQFsYUFPCVWL2piBLFZBFQllt46ClbDC1RzaWIDM8RiBYk5k2wm MHIvYGRYxSiaWpBcUJyUnmukV5yYW1yal66XnJ+7iRHs3WfSOxhXNVgcYhTgYFTi4f35rzxE iDWxrLgy9xCjBAezkgivf1pFiBBvSmJlVWpRfnxRaU5q8SFGaQ4WJXHeGzdzQ4QE0hNLUrNT UwtSi2CyTBycUg2MK3IvHysIkW6KzSnKOP3j1k2Z+b825UxImLX/UsNWld/s+6fxn3Z/W71O a0XfRU1vNrcX7ZqMDsdYesQ15ih7vU37ciXZbsmjTzn/Ltys3z2x86HCRcEvxyI+K+96vLj6 fbjlB97C7eG7ZmwvP2Y4OX7bY79CgQyJ+9F2l6R3KZrMX5uzqVVSX4mlOCPRUIu5qDgRAKJS LjXqAQAA Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Some formats are not supported in encoding or decoding mode for given type of buffer (e.g. V4L2_PIX_FMT_JPEG is supported on output buffer only while in decoding mode). Make S_FMT failing if not suitable format is found. Signed-off-by: Jacek Anaszewski --- drivers/media/platform/s5p-jpeg/jpeg-core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c index d7571cd..dfab848 100644 --- a/drivers/media/platform/s5p-jpeg/jpeg-core.c +++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c @@ -1345,6 +1345,14 @@ static int s5p_jpeg_s_fmt(struct s5p_jpeg_ctx *ct, struct v4l2_format *f) FMT_TYPE_OUTPUT : FMT_TYPE_CAPTURE; q_data->fmt = s5p_jpeg_find_format(ct, pix->pixelformat, f_type); + + if (!q_data->fmt) { + v4l2_err(&ct->jpeg->v4l2_dev, + "Fourcc format (0x%08x) invalid.\n", + f->fmt.pix.pixelformat); + return -EINVAL; + } + q_data->w = pix->width; q_data->h = pix->height; if (q_data->fmt->fourcc != V4L2_PIX_FMT_JPEG) {