From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
To: Justin Green <greenjustin@chromium.org>, linux-media@vger.kernel.org
Cc: tiffany.lin@mediatek.com, andrew-ct.chen@mediatek.com,
mchehab@kernel.org, matthias.bgg@gmail.com,
andrescj@chromium.org, yunfei.dong@mediatek.com,
Justin Green <greenjustin@google.com>
Subject: Re: [PATCH] mediatek/jpeg: validate data_offsets for v4l2 planes
Date: Thu, 23 Jun 2022 15:31:36 -0400 [thread overview]
Message-ID: <1e1e8934915380ebcf0a1d2af11ef8f54bc2c28a.camel@collabora.com> (raw)
In-Reply-To: <20220623191422.1157518-1-greenjustin@chromium.org>
Le jeudi 23 juin 2022 à 15:14 -0400, Justin Green a écrit :
> Validate V4L2 plane data_offset values. We need to make sure the size of
> the image we're encoding does not exceed the size of the buffer minus
> its offset.
>
> Signed-off-by: Justin Green <greenjustin@google.com>
> ---
> drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> index bc5b0a0168ec..8f5c1b9937bc 100644
> --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
> @@ -687,6 +687,10 @@ static int mtk_jpeg_buf_prepare(struct vb2_buffer *vb)
>
> for (i = 0; i < q_data->fmt->colplanes; i++) {
> plane_fmt = q_data->pix_mp.plane_fmt[i];
> + if (vb->planes[i].data_offset > vb2_plane_size(vb, i) ||
> + vb2_plane_size(vb, i) - vb->planes[i].data_offset
> + < plane_fmt.sizeimage)
> + return -EINVAL;
Just double checking, but has data_offset been verified already to prevent the
underflow ?
> if (ctx->enable_exif &&
> q_data->fmt->fourcc == V4L2_PIX_FMT_JPEG)
> vb2_set_plane_payload(vb, i, plane_fmt.sizeimage +
next prev parent reply other threads:[~2022-06-23 19:41 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-23 19:14 [PATCH] mediatek/jpeg: validate data_offsets for v4l2 planes Justin Green
2022-06-23 19:31 ` Nicolas Dufresne [this message]
2022-06-23 19:42 ` Justin Green
2022-06-23 19:48 ` Nicolas Dufresne
2022-06-23 20:27 ` Justin Green
2022-06-29 9:56 ` Hans Verkuil
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1e1e8934915380ebcf0a1d2af11ef8f54bc2c28a.camel@collabora.com \
--to=nicolas.dufresne@collabora.com \
--cc=andrescj@chromium.org \
--cc=andrew-ct.chen@mediatek.com \
--cc=greenjustin@chromium.org \
--cc=greenjustin@google.com \
--cc=linux-media@vger.kernel.org \
--cc=matthias.bgg@gmail.com \
--cc=mchehab@kernel.org \
--cc=tiffany.lin@mediatek.com \
--cc=yunfei.dong@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox