lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 385/917] media: TDA1997x: handle short reads of hdmi info frame.
    Date
    From: Tom Rix <trix@redhat.com>

    [ Upstream commit 48d219f9cc667bc6fbc3e3af0b1bfd75db94fce4 ]

    Static analysis reports this representative problem

    tda1997x.c:1939: warning: 7th function call argument is an uninitialized
    value

    The 7th argument is buffer[0], which is set in the earlier call to
    io_readn(). When io_readn() call to io_read() fails with the first
    read, buffer[0] is not set and 0 is returned and stored in len.

    The later call to hdmi_infoframe_unpack()'s size parameter is the
    static size of buffer, always 40, so a short read is not caught
    in hdmi_infoframe_unpacks()'s checking. The variable len should be
    used instead.

    Zero initialize buffer to 0 so it is in a known start state.

    Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")
    Signed-off-by: Tom Rix <trix@redhat.com>
    Reviewed-by: Tim Harvey <tharvey@gateworks.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/i2c/tda1997x.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
    index 6070aaf0b32ea..4dafa9f1cf522 100644
    --- a/drivers/media/i2c/tda1997x.c
    +++ b/drivers/media/i2c/tda1997x.c
    @@ -1248,13 +1248,13 @@ tda1997x_parse_infoframe(struct tda1997x_state *state, u16 addr)
    {
    struct v4l2_subdev *sd = &state->sd;
    union hdmi_infoframe frame;
    - u8 buffer[40];
    + u8 buffer[40] = { 0 };
    u8 reg;
    int len, err;

    /* read data */
    len = io_readn(sd, addr, sizeof(buffer), buffer);
    - err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer));
    + err = hdmi_infoframe_unpack(&frame, buffer, len);
    if (err) {
    v4l_err(state->client,
    "failed parsing %d byte infoframe: 0x%04x/0x%02x\n",
    @@ -1928,13 +1928,13 @@ static int tda1997x_log_infoframe(struct v4l2_subdev *sd, int addr)
    {
    struct tda1997x_state *state = to_state(sd);
    union hdmi_infoframe frame;
    - u8 buffer[40];
    + u8 buffer[40] = { 0 };
    int len, err;

    /* read data */
    len = io_readn(sd, addr, sizeof(buffer), buffer);
    v4l2_dbg(1, debug, sd, "infoframe: addr=%d len=%d\n", addr, len);
    - err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer));
    + err = hdmi_infoframe_unpack(&frame, buffer, len);
    if (err) {
    v4l_err(state->client,
    "failed parsing %d byte infoframe: 0x%04x/0x%02x\n",
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 02:10    [W:5.715 / U:0.400 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site