Commit abd77889 authored by Zhou Qingyang's avatar Zhou Qingyang Committed by Mauro Carvalho Chehab

media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats()

In cal_ctx_v4l2_init_formats(), devm_kzalloc() is assigned to
ctx->active_fmt and there is a dereference of it after that, which could
lead to NULL pointer dereference on failure of devm_kzalloc().

Fix this bug by adding a NULL check of ctx->active_fmt.

This bug was found by a static analyzer.

Builds with 'make allyesconfig' show no new warnings, and our static
analyzer no longer warns about this code.

Fixes: 71681550 ("media: ti-vpe: cal: Move format handling to cal.c and expose helpers")
Signed-off-by: default avatarZhou Qingyang <zhou1615@umn.edu>
Reviewed-by: default avatarPratyush Yadav <p.yadav@ti.com>
Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent cc74074a
...@@ -823,6 +823,9 @@ static int cal_ctx_v4l2_init_formats(struct cal_ctx *ctx) ...@@ -823,6 +823,9 @@ static int cal_ctx_v4l2_init_formats(struct cal_ctx *ctx)
/* Enumerate sub device formats and enable all matching local formats */ /* Enumerate sub device formats and enable all matching local formats */
ctx->active_fmt = devm_kcalloc(ctx->cal->dev, cal_num_formats, ctx->active_fmt = devm_kcalloc(ctx->cal->dev, cal_num_formats,
sizeof(*ctx->active_fmt), GFP_KERNEL); sizeof(*ctx->active_fmt), GFP_KERNEL);
if (!ctx->active_fmt)
return -ENOMEM;
ctx->num_active_fmt = 0; ctx->num_active_fmt = 0;
for (j = 0, i = 0; ; ++j) { for (j = 0, i = 0; ; ++j) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment