| Message ID | 20190727091547.11674-1-baijiaju1990@gmail.com (mailing list archive) |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | Andy Gross |
| Headers | show |
| Series | media: qcom: venus: Fix a possible null-pointer dereference in vdec_g_fmt() | expand |
This patch fell between the cracks, but while cleaning up patchwork it popped up again :-) On 7/27/19 11:15 AM, Jia-Ju Bai wrote: > In vdec_g_fmt(), fmt is firstly assigned NULL, and it could be never > assigned before being used on line 223: > pixmp->pixelformat = fmt->pixfmt; > > Thus, a possible null-pointer dereference may occur. > > To fix this bug, fmt is checked before being used here. Actually, this function can only be called for f->type values V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE or V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE. The easiest way to fix this is to replace this: if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) fmt = inst->fmt_cap; else if (f->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) fmt = inst->fmt_out; by: if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) fmt = inst->fmt_cap; else fmt = inst->fmt_out; And the same in a bit lower down in this function. Regards, Hans > > This bug is found by a static analysis tool STCheck written by us. > > Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> > --- > drivers/media/platform/qcom/venus/vdec.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c > index e1f998656c07..12c31551f191 100644 > --- a/drivers/media/platform/qcom/venus/vdec.c > +++ b/drivers/media/platform/qcom/venus/vdec.c > @@ -211,7 +211,8 @@ static int vdec_g_fmt(struct file *file, void *fh, struct v4l2_format *f) > inst->height = format.fmt.pix_mp.height; > } > > - pixmp->pixelformat = fmt->pixfmt; > + if (fmt) > + pixmp->pixelformat = fmt->pixfmt; > > if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) { > pixmp->width = inst->width; >
diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c index e1f998656c07..12c31551f191 100644 --- a/drivers/media/platform/qcom/venus/vdec.c +++ b/drivers/media/platform/qcom/venus/vdec.c @@ -211,7 +211,8 @@ static int vdec_g_fmt(struct file *file, void *fh, struct v4l2_format *f) inst->height = format.fmt.pix_mp.height; } - pixmp->pixelformat = fmt->pixfmt; + if (fmt) + pixmp->pixelformat = fmt->pixfmt; if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) { pixmp->width = inst->width;
In vdec_g_fmt(), fmt is firstly assigned NULL, and it could be never assigned before being used on line 223: pixmp->pixelformat = fmt->pixfmt; Thus, a possible null-pointer dereference may occur. To fix this bug, fmt is checked before being used here. This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- drivers/media/platform/qcom/venus/vdec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)