lkml.org 
[lkml]   [2022]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 126/475] media: video/hdmi: handle short reads of hdmi info frame.
    Date
    From: Tom Rix <trix@redhat.com>

    [ Upstream commit 4a92fc6e55da5b87cecb572275deaff6ac9dd27e ]

    Calling hdmi_infoframe_unpack() with static sizeof(buffer) skips all
    the size checking done later in hdmi_infoframe_unpack(). A better
    value is the amount of data read into buffer.

    Fixes: 480b8b3e42c3 ("video/hdmi: Pass buffer size to infoframe unpack functions")
    Signed-off-by: Tom Rix <trix@redhat.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/i2c/adv7511-v4l2.c | 2 +-
    drivers/media/i2c/adv7604.c | 2 +-
    drivers/media/i2c/adv7842.c | 2 +-
    3 files changed, 3 insertions(+), 3 deletions(-)

    diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c
    index 809fa44ed988..86267e01c251 100644
    --- a/drivers/media/i2c/adv7511-v4l2.c
    +++ b/drivers/media/i2c/adv7511-v4l2.c
    @@ -555,7 +555,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_
    buffer[3] = 0;
    buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);

    - if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {
    + if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) {
    v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
    return;
    }
    diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
    index b887299ac195..1cee69919e1b 100644
    --- a/drivers/media/i2c/adv7604.c
    +++ b/drivers/media/i2c/adv7604.c
    @@ -2444,7 +2444,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index,
    buffer[i + 3] = infoframe_read(sd,
    adv76xx_cri[index].payload_addr + i);

    - if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) {
    + if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) {
    v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__,
    adv76xx_cri[index].desc);
    return -ENOENT;
    diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
    index 02cbab826d0b..a581e822ce6f 100644
    --- a/drivers/media/i2c/adv7842.c
    +++ b/drivers/media/i2c/adv7842.c
    @@ -2574,7 +2574,7 @@ static void log_infoframe(struct v4l2_subdev *sd, struct adv7842_cfg_read_infofr
    for (i = 0; i < len; i++)
    buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i);

    - if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {
    + if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) {
    v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
    return;
    }
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-04-14 16:31    [W:4.065 / U:0.172 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site