OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

media: vicodec: check type in g/s_selection 

Check that the selection buf_type is valid before calling get_q_data() to
avoid hitting the WARN(1) in that function if the buffer type is not valid.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: syzbot+44b24cff6bf96006ecfa@syzkaller.appspotmail.com
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
This commit is contained in:
Hans Verkuil 2019-01-30 02:33:41 -05:00 committed by Mauro Carvalho Chehab
parent 801efd0f75
commit db9a01b32c
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/media/platform/vicodec/vicodec-core.c
View File

@ -953,6 +953,9 @@ static int vidioc_g_selection(struct file *file, void *priv,
valid_out_type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
}
if (s->type != valid_cap_type && s->type != valid_out_type)
return -EINVAL;
q_data = get_q_data(ctx, s->type);
if (!q_data)
return -EINVAL;
@ -994,12 +997,14 @@ static int vidioc_s_selection(struct file *file, void *priv,
if (multiplanar)
out_type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
if (s->type != out_type)
return -EINVAL;
q_data = get_q_data(ctx, s->type);
if (!q_data)
return -EINVAL;
if (!ctx->is_enc || s->type != out_type ||
s->target != V4L2_SEL_TGT_CROP)
if (!ctx->is_enc || s->target != V4L2_SEL_TGT_CROP)
return -EINVAL;
s->r.left = 0;