re: [media] gspca - topro: New subdriver for Topro webcams

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Jean-François Moine,

The patch 8f12b1ab2fac: "[media] gspca - topro: New subdriver for
Topro webcams" from Sep 22, 2011, leads to the following
static checker warning:
	drivers/media/usb/gspca/topro.c:4642
	sd_pkt_scan() warn: check 'data[]' for negative offsets s32min"

drivers/media/usb/gspca/topro.c
  4632                  data++;

Should there be an "if (len < 8) return;" here?

  4633                  len--;
  4634                  if (*data == 0xff && data[1] == 0xd8) {
  4635  /*fixme: there may be information in the 4 high bits*/
  4636                          if ((data[6] & 0x0f) != sd->quality)
  4637                                  set_dqt(gspca_dev, data[6] & 0x0f);
  4638                          gspca_frame_add(gspca_dev, FIRST_PACKET,
  4639                                          sd->jpeg_hdr, JPEG_HDR_SZ);
  4640                          gspca_frame_add(gspca_dev, INTER_PACKET,
  4641                                          data + 7, len - 7);
  4642                  } else if (data[len - 2] == 0xff && data[len - 1] == 0xd9) {
  4643                          gspca_frame_add(gspca_dev, LAST_PACKET,
  4644                                          data, len);
  4645                  } else {
  4646                          gspca_frame_add(gspca_dev, INTER_PACKET,
  4647                                          data, len);
  4648                  }
  4649                  return;
  4650          }
  4651  
  4652          switch (*data) {
  4653          case 0x55:
  4654                  gspca_frame_add(gspca_dev, LAST_PACKET, data, 0);
  4655  
  4656                  if (len < 8
                            ^^^^^^^
The same as there is here.

  4657                   || data[1] != 0xff || data[2] != 0xd8
  4658                   || data[3] != 0xff || data[4] != 0xfe) {
  4659  
  4660                          /* Have only seen this with corrupt frames */
  4661                          gspca_dev->last_packet_type = DISCARD_PACKET;
  4662                          return;
  4663                  }
  4664                  if (data[7] != sd->quality)
  4665                          set_dqt(gspca_dev, data[7]);
  4666                  gspca_frame_add(gspca_dev, FIRST_PACKET,
  4667                                  sd->jpeg_hdr, JPEG_HDR_SZ);
  4668                  gspca_frame_add(gspca_dev, INTER_PACKET,
  4669                                  data + 8, len - 8);
  4670                  break;
  4671          case 0xaa:
  4672                  gspca_dev->last_packet_type = DISCARD_PACKET;
  4673                  break;
  4674          case 0xcc:

I suppose we could add a "if (len < 1)" here as well.

  4675                  if (data[1] != 0xff || data[2] != 0xd8)
  4676                          gspca_frame_add(gspca_dev, INTER_PACKET,
  4677                                          data + 1, len - 1);
  4678                  else
  4679                          gspca_dev->last_packet_type = DISCARD_PACKET;
  4680                  break;
  4681          }
  4682  }


regards,
dan carpenter