From: Dan Carpenter <dan.carpenter@oracle.com>
To: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Cc: "Mauro Carvalho Chehab" <mchehab@kernel.org>,
"Amber Jain" <amber@ti.com>,
"Niklas Söderlund" <niklas.soderlund+renesas@ragnatech.se>,
"Philipp Zabel" <p.zabel@pengutronix.de>,
"Benoit Parrot" <bparrot@ti.com>,
linux-media@vger.kernel.org, kernel-janitors@vger.kernel.org,
"Andrzej Hajda" <a.hajda@samsung.com>
Subject: Re: [PATCH] media: omap_vout: potential buffer overflow in vidioc_dqbuf()
Date: Wed, 10 Apr 2019 11:14:15 +0000 [thread overview]
Message-ID: <20190410111415.GB31633@kadam> (raw)
In-Reply-To: <eb4fe291-85b5-540b-c210-5e9fb051f2cc@xs4all.nl>
On Wed, Apr 10, 2019 at 12:50:31PM +0200, Hans Verkuil wrote:
> On 4/9/19 1:29 PM, Dan Carpenter wrote:
> > diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
> > index 37f0d7146dfa..15e38990e85a 100644
> > --- a/drivers/media/platform/omap/omap_vout.c
> > +++ b/drivers/media/platform/omap/omap_vout.c
> > @@ -1527,8 +1527,6 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
> > unsigned long size;
> > struct videobuf_buffer *vb;
> >
> > - vb = q->bufs[b->index];
> > -
> > if (!vout->streaming)
> > return -EINVAL;
> >
> > @@ -1539,6 +1537,8 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
> > /* Call videobuf_dqbuf for blocking mode */
> > ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
>
> We need a:
>
> if (ret)
> return ret;
>
> here. Or alternatively, add 'if (!ret)' around the next five lines.
>
> b->index is only valid if the videobuf_dqbuf call returned 0.
>
Doh. Thanks.
regards,
dan carpenter
next prev parent reply other threads:[~2019-04-10 11:14 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-09 11:29 [PATCH] media: omap_vout: potential buffer overflow in vidioc_dqbuf() Dan Carpenter
2019-04-10 10:50 ` Hans Verkuil
2019-04-10 11:14 ` Dan Carpenter [this message]
2019-04-10 14:05 ` [EXTERNAL] " Scheurer, Amber
2019-04-11 9:01 ` [PATCH v2] " Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190410111415.GB31633@kadam \
--to=dan.carpenter@oracle.com \
--cc=a.hajda@samsung.com \
--cc=amber@ti.com \
--cc=bparrot@ti.com \
--cc=hverkuil-cisco@xs4all.nl \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=niklas.soderlund+renesas@ragnatech.se \
--cc=p.zabel@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox