samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

video: format: Add bounds check

Browse Source 
Add bounds check on fmtdesc index
to prevent out-of-bounds array access.

Change-Id: I52873426714c8a15c0fe7b0971fe5737a549c691
Signed-off-by: Elliot Berman <eberman@codeaurora.org>
This commit is contained in:
Elliot Berman
2021-03-16 10:33:26 -07:00
committed by Darshana Patil
parent 3dc0696b1d
commit 1147530e8c
2 changed files with 23 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
driver/vidc/src/msm_vdec.c
View File

@@ -2248,9 +2248,10 @@ int msm_vdec_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f)
int rc = 0;
struct msm_vidc_core *core;
u32 array[32] = {0};
u32 i = 0, idx = 0;
u32 i = 0;
if (!inst || !inst->core || !inst->capabilities || !f) {
if (!inst || !inst->core || !inst->capabilities || !f ||
f->index >= ARRAY_SIZE(array)) {
d_vpr_e("%s: invalid params\n", __func__);
return -EINVAL;
}
@@ -2258,15 +2259,15 @@ int msm_vdec_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f)
if (f->type == INPUT_MPLANE) {
u32 codecs = core->capabilities[DEC_CODECS].value;
u32 idx = 0;
while (codecs) {
if (i > 31)
break;
for (i = 0; i <= 31; i++) {
if (codecs & BIT(i)) {
if (idx >= ARRAY_SIZE(array))
break;
array[idx] = codecs & BIT(i);
idx++;
}
i++;
}
f->pixelformat = v4l2_codec_from_driver(array[f->index],
__func__);
@@ -2276,18 +2277,18 @@ int msm_vdec_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f)
strlcpy(f->description, "codec", sizeof(f->description));
} else if (f->type == OUTPUT_MPLANE) {
u32 formats = inst->capabilities->cap[PIX_FMTS].step_or_mask;
u32 idx = 0;
while (formats) {
if (i > 31)
break;
for (i = 0; i <= 31; i++) {
if (formats & BIT(i)) {
if (idx >= ARRAY_SIZE(array))
break;
if (msm_vdec_check_colorformat_supported(inst,
formats & BIT(i))) {
array[idx] = formats & BIT(i);
idx++;
}
}
i++;
}
f->pixelformat = v4l2_colorformat_from_driver(array[f->index],
__func__);

23
driver/vidc/src/msm_venc.c
View File

@@ -1630,25 +1630,26 @@ int msm_venc_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f)
int rc = 0;
struct msm_vidc_core *core;
u32 array[32] = {0};
u32 i = 0, idx = 0;
u32 i = 0;
if (!inst || !inst->core || !inst->capabilities || !f) {
if (!inst || !inst->core || !inst->capabilities || !f ||
f->index >= ARRAY_SIZE(array)) {
d_vpr_e("%s: invalid params\n", __func__);
return -EINVAL;
}
core = inst->core;
if (f->type == OUTPUT_MPLANE) {
u32 codecs = core->capabilities[DEC_CODECS].value;
u32 codecs = core->capabilities[ENC_CODECS].value;
u32 idx = 0;
while (codecs) {
if (i > 31)
break;
for (i = 0; i <= 31; i++) {
if (codecs & BIT(i)) {
if (idx >= ARRAY_SIZE(array))
break;
array[idx] = codecs & BIT(i);
idx++;
}
i++;
}
f->pixelformat = v4l2_codec_from_driver(array[f->index],
__func__);
@@ -1658,15 +1659,15 @@ int msm_venc_enum_fmt(struct msm_vidc_inst *inst, struct v4l2_fmtdesc *f)
strlcpy(f->description, "codec", sizeof(f->description));
} else if (f->type == INPUT_MPLANE) {
u32 formats = inst->capabilities->cap[PIX_FMTS].step_or_mask;
u32 idx = 0;
while (formats) {
if (idx > 31)
break;
for (i = 0; i <= 31; i++) {
if (formats & BIT(i)) {
if (idx >= ARRAY_SIZE(array))
break;
array[idx] = formats & BIT(i);
idx++;
}
i++;
}
f->pixelformat = v4l2_colorformat_from_driver(array[f->index],
__func__);