lkml.org 
[lkml]   [2020]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 200/343] media: davinci/vpbe: array underflow in vpbe_enum_outputs()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit b72845ee5577b227131b1fef23f9d9a296621d7b ]

    In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
    the problem is that "temp_index" can be negative. This patch changes
    the types to unsigned to address this array underflow bug.

    Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/platform/davinci/vpbe.c | 2 +-
    include/media/davinci/vpbe.h | 2 +-
    2 files changed, 2 insertions(+), 2 deletions(-)

    diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
    index 1d3c13e369044..915af9ca47111 100644
    --- a/drivers/media/platform/davinci/vpbe.c
    +++ b/drivers/media/platform/davinci/vpbe.c
    @@ -126,7 +126,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
    struct v4l2_output *output)
    {
    struct vpbe_config *cfg = vpbe_dev->cfg;
    - int temp_index = output->index;
    + unsigned int temp_index = output->index;

    if (temp_index >= cfg->num_outputs)
    return -EINVAL;
    diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h
    index 79a566d7defd0..180a05e914979 100644
    --- a/include/media/davinci/vpbe.h
    +++ b/include/media/davinci/vpbe.h
    @@ -92,7 +92,7 @@ struct vpbe_config {
    struct encoder_config_info *ext_encoders;
    /* amplifier information goes here */
    struct amp_config_info *amp;
    - int num_outputs;
    + unsigned int num_outputs;
    /* Order is venc outputs followed by LCD and then external encoders */
    struct vpbe_output *outputs;
    };
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-24 10:58    [W:4.877 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site