[PATCH] s5p-jpeg: Fix possible NULL pointer dereference in s_fmt

[PATCH] s5p-jpeg: Fix possible NULL pointer dereference in s_fmt

[Jacek Anaszewski]

Some formats are not supported in encoding or decoding
mode for given type of buffer (e.g. V4L2_PIX_FMT_JPEG
is supported on output buffer only while in decoding
mode). Make S_FMT failing if not suitable format
is found.

Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com>
---
 drivers/media/platform/s5p-jpeg/jpeg-core.c |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index d7571cd..dfab848 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -1345,6 +1345,14 @@ static int s5p_jpeg_s_fmt(struct s5p_jpeg_ctx *ct, struct v4l2_format *f)
 			FMT_TYPE_OUTPUT : FMT_TYPE_CAPTURE;
 
 	q_data->fmt = s5p_jpeg_find_format(ct, pix->pixelformat, f_type);
+
+	if (!q_data->fmt) {
+		v4l2_err(&ct->jpeg->v4l2_dev,
+			 "Fourcc format (0x%08x) invalid.\n",
+			 f->fmt.pix.pixelformat);
+		return -EINVAL;
+	}
+
 	q_data->w = pix->width;
 	q_data->h = pix->height;
 	if (q_data->fmt->fourcc != V4L2_PIX_FMT_JPEG) {
-- 
1.7.9.5

Re: [PATCH] s5p-jpeg: Fix possible NULL pointer dereference in s_fmt

[Sylwester Nawrocki]

Hi Jacek,

On 28/11/14 14:10, Jacek Anaszewski wrote:
> Some formats are not supported in encoding or decoding
> mode for given type of buffer (e.g. V4L2_PIX_FMT_JPEG
> is supported on output buffer only while in decoding
> mode). Make S_FMT failing if not suitable format
> is found.
> 
> Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com>
> ---
>  drivers/media/platform/s5p-jpeg/jpeg-core.c |    8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
> index d7571cd..dfab848 100644
> --- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
> +++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
> @@ -1345,6 +1345,14 @@ static int s5p_jpeg_s_fmt(struct s5p_jpeg_ctx *ct, struct v4l2_format *f)
>  			FMT_TYPE_OUTPUT : FMT_TYPE_CAPTURE;
>  
>  	q_data->fmt = s5p_jpeg_find_format(ct, pix->pixelformat, f_type);
> +
> +	if (!q_data->fmt) {
> +		v4l2_err(&ct->jpeg->v4l2_dev,
> +			 "Fourcc format (0x%08x) invalid.\n",
> +			 f->fmt.pix.pixelformat);
> +		return -EINVAL;
> +	}
> +

How about forcing one of valid formats instead ? VIDIOC_S_FMT is not
supposed to return an error just because a not supported fourcc
was passed from user space.

--
Thanks,
Sylwester