From patchwork Tue May 9 08:07:52 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pavel Machek X-Patchwork-Id: 41239 Received: from mail.tu-berlin.de ([130.149.7.33]) by www.linuxtv.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d80Bd-0004wY-Gn; Tue, 09 May 2017 08:08:01 +0000 X-tubIT-Incoming-IP: 209.132.180.67 Received: from vger.kernel.org ([209.132.180.67]) by mail.tu-berlin.de (exim-4.84_2/mailfrontend-8) with esmtp id 1d80Bb-0005ZC-kj; Tue, 09 May 2017 10:08:01 +0200 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750994AbdEIIH5 (ORCPT + 1 other); Tue, 9 May 2017 04:07:57 -0400 Received: from atrey.karlin.mff.cuni.cz ([195.113.26.193]:60710 "EHLO atrey.karlin.mff.cuni.cz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750825AbdEIIHy (ORCPT ); Tue, 9 May 2017 04:07:54 -0400 Received: by atrey.karlin.mff.cuni.cz (Postfix, from userid 512) id 9687681C2E; Tue, 9 May 2017 10:07:52 +0200 (CEST) Date: Tue, 9 May 2017 10:07:52 +0200 From: Pavel Machek To: Ivaylo Dimitrov Cc: Mauro Carvalho Chehab , pali.rohar@gmail.com, sre@kernel.org, Sakari Ailus , Sakari Ailus , linux-media@vger.kernel.org, hans.verkuil@cisco.com Subject: Re: [patch, libv4l]: fix integer overflow Message-ID: <20170509080752.GA19912@amd> References: <20170419105118.72b8e284@vento.lan> <20170424093059.GA20427@amd> <20170424103802.00d3b554@vento.lan> <20170424212914.GA20780@amd> <20170424224724.5bb52382@vento.lan> <20170426105300.GA857@amd> <20170426081330.6ca10e42@vento.lan> <20170426132337.GA6482@amd> <20170508222819.GA14833@amd> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20170508222819.GA14833@amd> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2017.5.9.80016 X-PMX-Spam: Gauge=IIIIIIIII, Probability=9%, Report=' BODY_PARA_IS_SENTENCE_URL 0.1, MULTIPLE_RCPTS 0.1, HTML_00_01 0.05, HTML_00_10 0.05, KNOWN_FREEWEB_URI 0.05, MSGID_ADDED_BY_MTA 0.05, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_1600_1699 0, BODY_SIZE_2000_LESS 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, INVALID_MSGID_NO_FQDN 0, IN_REP_TO 0, LEGITIMATE_SIGNS 0, MSG_THREAD 0, MULTIPLE_REAL_RCPTS 0, NO_URI_HTTPS 0, REFERENCES 0, URI_ENDS_IN_HTML 0, URI_WITH_PATH_ONLY 0, __ANY_URI 0, __ATTACHMENT_SIZE_0_10K 0, __BOUNCE_CHALLENGE_SUBJ 0, __BOUNCE_NDR_SUBJ_EXEMPT 0, __CC_NAME 0, __CC_NAME_DIFF_FROM_ACC 0, __CC_REAL_NAMES 0, __CD 0, __CP_URI_IN_BODY 0, __CT 0, __CTYPE_HAS_BOUNDARY 0, __CTYPE_MULTIPART 0, __HAS_ATTACHMENT 0, __HAS_ATTACHMENT1 0, __HAS_ATTACHMENT2 0, __HAS_CC_HDR 0, __HAS_FROM 0, __HAS_LIST_ID 0, __HAS_MSGID 0, __HAS_X_MAILING_LIST 0, __IN_REP_TO 0, __KNOWN_FREEWEB_URI2 0, __MIME_TEXT_P 0, __MIME_TEXT_P1 0, __MIME_TEXT_P2 0, __MIME_VERSION 0, __MULTIPLE_RCPTS_CC_X2 0, __MULTIPLE_URI_TEXT 0, __NO_HTML_TAG_RAW 0, __REFERENCES 0, __SANE_MSGID 0, __SUBJ_ALPHA_END 0, __SUBJ_ALPHA_NEGATE 0, __TO_MALFORMED_2 0, __TO_NAME 0, __TO_NAME_DIFF_FROM_ACC 0, __TO_REAL_NAMES 0, __URI_IN_BODY 0, __URI_NOT_IMG 0, __URI_NS , __URI_WITH_PATH 0, __USER_AGENT 0' Fix integer overflow with EXPOSURE_ABSOLUTE. This is problem for example with Nokia N900. Signed-off-by: Pavel Machek diff --git a/lib/libv4l2/libv4l2.c b/lib/libv4l2/libv4l2.c index e795aee..189fc06 100644 --- a/lib/libv4l2/libv4l2.c +++ b/lib/libv4l2/libv4l2.c @@ -1776,7 +1776,7 @@ int v4l2_set_control(int fd, int cid, int value) if (qctrl.type == V4L2_CTRL_TYPE_BOOLEAN) ctrl.value = value ? 1 : 0; else - ctrl.value = (value * (qctrl.maximum - qctrl.minimum) + 32767) / 65535 + + ctrl.value = ((long long) value * (qctrl.maximum - qctrl.minimum) + 32767) / 65535 + qctrl.minimum; result = v4lconvert_vidioc_s_ctrl(devices[index].convert, &ctrl); @@ -1812,7 +1812,7 @@ int v4l2_get_control(int fd, int cid) if (v4l2_propagate_ioctl(index, VIDIOC_G_CTRL, &ctrl)) return -1; - return ((ctrl.value - qctrl.minimum) * 65535 + + return (((long long) ctrl.value - qctrl.minimum) * 65535 + (qctrl.maximum - qctrl.minimum) / 2) / (qctrl.maximum - qctrl.minimum); }