diff mbox series

media: v4l2-ctrls-core.c: check min/max for menu controls

Message ID 6af38faa-a10c-40e2-873b-c4288a68c5aa@xs4all.nl (mailing list archive)
State Superseded
Delegated to: Hans Verkuil
Headers
Series media: v4l2-ctrls-core.c: check min/max for menu controls |

Commit Message

Hans Verkuil Feb. 2, 2024, 10:38 a.m. UTC 
Menu controls require that the min-max range is inside 0-63.

Negative values obviously make no sense for menu controls, and the maximum
value is currently limited by the number of bits of the menu_skip_mask value.

If we ever need to add support for larger menus, then more work is needed.

For now just check that everything is within range.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
---

Comments

Nicolas Dufresne Feb. 9, 2024, 3:54 p.m. UTC | #1 
Le vendredi 02 février 2024 à 11:38 +0100, Hans Verkuil a écrit :
> Menu controls require that the min-max range is inside 0-63.
> 
> Negative values obviously make no sense for menu controls, and the maximum
> value is currently limited by the number of bits of the menu_skip_mask value.
> 
> If we ever need to add support for larger menus, then more work is needed.
> 
> For now just check that everything is within range.
> 
> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>

> ---
> diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
> index a662fb60f73f..89d1e3e78563 100644
> --- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
> +++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
> @@ -1504,7 +1504,8 @@ int check_range(enum v4l2_ctrl_type type,
>  		return 0;
>  	case V4L2_CTRL_TYPE_MENU:
>  	case V4L2_CTRL_TYPE_INTEGER_MENU:
> -		if (min > max || def < min || def > max)
> +		if (min > max || def < min || def > max ||
> +		    min < 0 || max >= BITS_PER_LONG_LONG)
>  			return -ERANGE;
>  		/* Note: step == menu_skip_mask for menu controls.
>  		   So here we check if the default value is masked out. */
>
diff mbox series

Patch

diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
index a662fb60f73f..89d1e3e78563 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -1504,7 +1504,8 @@  int check_range(enum v4l2_ctrl_type type,
 		return 0;
 	case V4L2_CTRL_TYPE_MENU:
 	case V4L2_CTRL_TYPE_INTEGER_MENU:
-		if (min > max || def < min || def > max)
+		if (min > max || def < min || def > max ||
+		    min < 0 || max >= BITS_PER_LONG_LONG)
 			return -ERANGE;
 		/* Note: step == menu_skip_mask for menu controls.
 		   So here we check if the default value is masked out. */