summaryrefslogtreecommitdiff
path: root/drivers/media/platform/vicodec
diff options
context:
space:
mode:
authorHans Verkuil <hverkuil-cisco@xs4all.nl>2019-01-30 02:33:41 -0500
committerMauro Carvalho Chehab <mchehab+samsung@kernel.org>2019-02-07 11:49:53 -0500
commitdb9a01b32ca9406394e6e7d19c4cdfcf1cbb5058 (patch)
tree23ad11a1af7ce6780df6d0057811809e34655eab /drivers/media/platform/vicodec
parent801efd0f7522244b5c09fc4c6630dc55fb37c26c (diff)
media: vicodec: check type in g/s_selection
Check that the selection buf_type is valid before calling get_q_data() to avoid hitting the WARN(1) in that function if the buffer type is not valid. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reported-by: syzbot+44b24cff6bf96006ecfa@syzkaller.appspotmail.com Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Diffstat (limited to 'drivers/media/platform/vicodec')
-rw-r--r--drivers/media/platform/vicodec/vicodec-core.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
index 3703b587e25e..cda348114764 100644
--- a/drivers/media/platform/vicodec/vicodec-core.c
+++ b/drivers/media/platform/vicodec/vicodec-core.c
@@ -953,6 +953,9 @@ static int vidioc_g_selection(struct file *file, void *priv,
valid_out_type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
}
+ if (s->type != valid_cap_type && s->type != valid_out_type)
+ return -EINVAL;
+
q_data = get_q_data(ctx, s->type);
if (!q_data)
return -EINVAL;
@@ -994,12 +997,14 @@ static int vidioc_s_selection(struct file *file, void *priv,
if (multiplanar)
out_type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
+ if (s->type != out_type)
+ return -EINVAL;
+
q_data = get_q_data(ctx, s->type);
if (!q_data)
return -EINVAL;
- if (!ctx->is_enc || s->type != out_type ||
- s->target != V4L2_SEL_TGT_CROP)
+ if (!ctx->is_enc || s->target != V4L2_SEL_TGT_CROP)
return -EINVAL;
s->r.left = 0;