Commit 115b7ac2 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab

media: atomisp2: array underflow in ap1302_enum_frame_size()

The problem is this code from ap1302_enum_frame_size():

   738          int index = fse->index;
   739
   740          mutex_lock(&dev->input_lock);
   741          context = ap1302_get_context(sd);
   742          if (index >= dev->cntx_res[context].res_num) {
   743                  mutex_unlock(&dev->input_lock);
   744                  return -EINVAL;
   745          }
   746
   747          res_table = dev->cntx_res[context].res_table;
   748          fse->min_width = res_table[index].width;

"fse->index" is a u32 that come from the user.  We want negative values
of "index" to be treated as -EINVAL but they're not so we can read from
before the start of the res_table[] array.

I've fixed this by making "res_num" a u32.  I made "cur_res" a u32 as
well, just for consistency.

Fixes: a49d2536 ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent 7b065c55
...@@ -158,8 +158,8 @@ struct ap1302_res_struct { ...@@ -158,8 +158,8 @@ struct ap1302_res_struct {
}; };
struct ap1302_context_res { struct ap1302_context_res {
s32 res_num; u32 res_num;
s32 cur_res; u32 cur_res;
struct ap1302_res_struct *res_table; struct ap1302_res_struct *res_table;
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment