renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-27 06:34:11 +08:00
Code

[media] vivid: sanitize selection rectangle

Browse Source 
Handle values like ~0 as width, height, left or top fields.
Just strip off the top 16 bits will ensure that the calculations
remain OK.

Found with v4l2-compliance.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This commit is contained in:
Hans Verkuil 2015-03-15 13:40:04 -03:00 committed by Mauro Carvalho Chehab
parent 29813a6f34
commit 82bdb26abc
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/media/platform/vivid/vivid-vid-common.c
View File

@ -694,6 +694,9 @@ int vivid_vid_adjust_sel(unsigned flags, struct v4l2_rect *r)
unsigned w = r->width;
unsigned h = r->height;
/* sanitize w and h in case someone passes ~0 as the value */
w &= 0xffff;
h &= 0xffff;
if (!(flags & V4L2_SEL_FLAG_LE)) {
w++;
h++;
@ -718,8 +721,9 @@ int vivid_vid_adjust_sel(unsigned flags, struct v4l2_rect *r)
r->top = 0;
if (r->left < 0)
r->left = 0;
r->left &= ~1;
r->top &= ~1;
/* sanitize left and top in case someone passes ~0 as the value */
r->left &= 0xfffe;
r->top &= 0xfffe;
if (r->left + w > MAX_WIDTH)
r->left = MAX_WIDTH - w;
if (r->top + h > MAX_HEIGHT)