lkml.org 
[lkml]   [2017]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] [media] s3c-camif: fix out-of-bounds array access
From
Date
On 09/13/2017 04:03 PM, Arnd Bergmann wrote:
> On Wed, Sep 13, 2017 at 11:25 AM, Sylwester Nawrocki
> <s.nawrocki@samsung.com> wrote:
>> On 09/12/2017 10:09 PM, Arnd Bergmann wrote:
>>> {
>>> const struct s3c_camif_variant *variant = camif->variant;
>>> const struct vp_pix_limits *pix_lim;
>>> - int i = ARRAY_SIZE(camif_mbus_formats);
>>>
>>> /* FIXME: constraints against codec or preview path ? */
>>> pix_lim = &variant->vp_pix_limits[VP_CODEC];
>>>
>>> - while (i-- >= 0)
>>> - if (camif_mbus_formats[i] == mf->code)
>>> - break;
>>> -
>>> - mf->code = camif_mbus_formats[i];
>>
>> Interesting finding... the function needs to ensure mf->code is set
>> to one of supported values by the driver, so instead of removing
>> how about changing the above line to:
>>
>> if (i < 0)
>> mf->code = camif_mbus_formats[0];
>>
>> ?
> That would still have one of the two out-of-bounds accesses;-)

Ah, indeed :/

> maybe this
>
> for (i = 0; i < ARRAY_SIZE(camif_mbus_formats); i++)
> if (camif_mbus_formats[i] == mf->code)
> break;
>
> if (i == ARRAY_SIZE(camif_mbus_formats))
> mf->code = camif_mbus_formats[0];

Yes, it should work that way.

--
Thanks,
Sylwester

\
 
 \ /
  Last update: 2017-09-13 17:55    [W:4.178 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site