diff options
| author | Hans Verkuil | 2019-01-30 08:33:41 +0100 |
|---|---|---|
| committer | Mauro Carvalho Chehab | 2019-02-07 17:49:53 +0100 |
| commit | db9a01b32ca9406394e6e7d19c4cdfcf1cbb5058 (patch) | |
| tree | 23ad11a1af7ce6780df6d0057811809e34655eab /drivers/media/platform/vicodec/vicodec-core.c | |
| parent | media: imx-pxp: fix duplicated if condition (diff) | |
| download | kernel-qcow2-linux-db9a01b32ca9406394e6e7d19c4cdfcf1cbb5058.tar.gz kernel-qcow2-linux-db9a01b32ca9406394e6e7d19c4cdfcf1cbb5058.tar.xz kernel-qcow2-linux-db9a01b32ca9406394e6e7d19c4cdfcf1cbb5058.zip | |
media: vicodec: check type in g/s_selection
Check that the selection buf_type is valid before calling get_q_data() to
avoid hitting the WARN(1) in that function if the buffer type is not valid.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: syzbot+44b24cff6bf96006ecfa@syzkaller.appspotmail.com
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Diffstat (limited to 'drivers/media/platform/vicodec/vicodec-core.c')
| -rw-r--r-- | drivers/media/platform/vicodec/vicodec-core.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c index 3703b587e25e..cda348114764 100644 --- a/drivers/media/platform/vicodec/vicodec-core.c +++ b/drivers/media/platform/vicodec/vicodec-core.c @@ -953,6 +953,9 @@ static int vidioc_g_selection(struct file *file, void *priv, valid_out_type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE; } + if (s->type != valid_cap_type && s->type != valid_out_type) + return -EINVAL; + q_data = get_q_data(ctx, s->type); if (!q_data) return -EINVAL; @@ -994,12 +997,14 @@ static int vidioc_s_selection(struct file *file, void *priv, if (multiplanar) out_type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE; + if (s->type != out_type) + return -EINVAL; + q_data = get_q_data(ctx, s->type); if (!q_data) return -EINVAL; - if (!ctx->is_enc || s->type != out_type || - s->target != V4L2_SEL_TGT_CROP) + if (!ctx->is_enc || s->target != V4L2_SEL_TGT_CROP) return -EINVAL; s->r.left = 0; |