lkml.org 
[lkml]   [2021]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 190/663] media: atomisp: Fix a buffer overflow in debug code
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 625993166b551d633917ca35d4afb7b46d7451b4 ]

    The "pad" variable is a user controlled string and we haven't properly
    clamped it at this point so the debug code could print from beyond the
    of the array.

    Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    .../media/atomisp/pci/atomisp_subdev.c | 24 ++++++++++++-------
    1 file changed, 16 insertions(+), 8 deletions(-)

    diff --git a/drivers/staging/media/atomisp/pci/atomisp_subdev.c b/drivers/staging/media/atomisp/pci/atomisp_subdev.c
    index 52b9fb18c87f0..dcc2dd981ca60 100644
    --- a/drivers/staging/media/atomisp/pci/atomisp_subdev.c
    +++ b/drivers/staging/media/atomisp/pci/atomisp_subdev.c
    @@ -349,12 +349,20 @@ static int isp_subdev_get_selection(struct v4l2_subdev *sd,
    return 0;
    }

    -static char *atomisp_pad_str[] = { "ATOMISP_SUBDEV_PAD_SINK",
    - "ATOMISP_SUBDEV_PAD_SOURCE_CAPTURE",
    - "ATOMISP_SUBDEV_PAD_SOURCE_VF",
    - "ATOMISP_SUBDEV_PAD_SOURCE_PREVIEW",
    - "ATOMISP_SUBDEV_PAD_SOURCE_VIDEO"
    - };
    +static const char *atomisp_pad_str(unsigned int pad)
    +{
    + static const char *const pad_str[] = {
    + "ATOMISP_SUBDEV_PAD_SINK",
    + "ATOMISP_SUBDEV_PAD_SOURCE_CAPTURE",
    + "ATOMISP_SUBDEV_PAD_SOURCE_VF",
    + "ATOMISP_SUBDEV_PAD_SOURCE_PREVIEW",
    + "ATOMISP_SUBDEV_PAD_SOURCE_VIDEO",
    + };
    +
    + if (pad >= ARRAY_SIZE(pad_str))
    + return "ATOMISP_INVALID_PAD";
    + return pad_str[pad];
    +}

    int atomisp_subdev_set_selection(struct v4l2_subdev *sd,
    struct v4l2_subdev_pad_config *cfg,
    @@ -378,7 +386,7 @@ int atomisp_subdev_set_selection(struct v4l2_subdev *sd,

    dev_dbg(isp->dev,
    "sel: pad %s tgt %s l %d t %d w %d h %d which %s f 0x%8.8x\n",
    - atomisp_pad_str[pad], target == V4L2_SEL_TGT_CROP
    + atomisp_pad_str(pad), target == V4L2_SEL_TGT_CROP
    ? "V4L2_SEL_TGT_CROP" : "V4L2_SEL_TGT_COMPOSE",
    r->left, r->top, r->width, r->height,
    which == V4L2_SUBDEV_FORMAT_TRY ? "V4L2_SUBDEV_FORMAT_TRY"
    @@ -612,7 +620,7 @@ void atomisp_subdev_set_ffmt(struct v4l2_subdev *sd,
    enum atomisp_input_stream_id stream_id;

    dev_dbg(isp->dev, "ffmt: pad %s w %d h %d code 0x%8.8x which %s\n",
    - atomisp_pad_str[pad], ffmt->width, ffmt->height, ffmt->code,
    + atomisp_pad_str(pad), ffmt->width, ffmt->height, ffmt->code,
    which == V4L2_SUBDEV_FORMAT_TRY ? "V4L2_SUBDEV_FORMAT_TRY"
    : "V4L2_SUBDEV_FORMAT_ACTIVE");

    --
    2.27.0


    \
     
     \ /
      Last update: 2021-03-02 01:11    [W:2.503 / U:0.272 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site