LinuxTV Patchwork [03/14] media: ov6650: Fix unverified arguments used in .set_fmt()

login
register
mail settings
Submitter Janusz Krzysztofik
Date April 8, 2019, 9:42 p.m.
Message ID <20190408214242.9603-4-jmkrzyszt@gmail.com>
Download mbox | patch
Permalink /patch/55559/
State New
Delegated to: Sakari Ailus
Headers show

Comments

Janusz Krzysztofik - April 8, 2019, 9:42 p.m.
Commit 717fd5b4907ad ("[media] v4l2: replace try_mbus_fmt by set_fmt")
converted a former ov6650_try_fmt() video operation callback to an
ov6650_set_fmt() pad operation callback.  However, the function does not
verify correctness of user provided format->which flag and pad config
pointer arguments.  Fix it.

Fixes: 717fd5b4907ad ("[media] v4l2: replace try_mbus_fmt by set_fmt")
Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
Cc: stable@vger.kernel.org
---
 drivers/media/i2c/ov6650.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

Patch

diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
index 007f0ca24913..3062c9a6c57b 100644
--- a/drivers/media/i2c/ov6650.c
+++ b/drivers/media/i2c/ov6650.c
@@ -679,6 +679,17 @@  static int ov6650_set_fmt(struct v4l2_subdev *sd,
 	if (format->pad)
 		return -EINVAL;
 
+	switch (format->which) {
+	case V4L2_SUBDEV_FORMAT_ACTIVE:
+		break;
+	case V4L2_SUBDEV_FORMAT_TRY:
+		if (cfg)
+			break;
+		/* fall through */
+	default:
+		return -EINVAL;
+	}
+
 	if (is_unscaled_ok(mf->width, mf->height, &priv->rect))
 		v4l_bound_align_image(&mf->width, 2, W_CIF, 1,
 				&mf->height, 2, H_CIF, 1, 0);

Privacy Policy