diff options
| author | Hans Verkuil <hans.verkuil@cisco.com> | 2015-03-15 13:40:04 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2015-04-02 21:10:45 -0300 |
| commit | 82bdb26abcae2988c74be29203caf23dabbe4be3 (patch) | |
| tree | 4fae28f342b03aa3ea8762ab3d82db1996a7846a | |
| parent | 29813a6f34042da13d201694964d9dea3d4658ef (diff) | |
| download | op-kernel-dev-82bdb26abcae2988c74be29203caf23dabbe4be3.zip op-kernel-dev-82bdb26abcae2988c74be29203caf23dabbe4be3.tar.gz | |
[media] vivid: sanitize selection rectangle
Handle values like ~0 as width, height, left or top fields.
Just strip off the top 16 bits will ensure that the calculations
remain OK.
Found with v4l2-compliance.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
| -rw-r--r-- | drivers/media/platform/vivid/vivid-vid-common.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c index 283b2e8..53f0c1d 100644 --- a/drivers/media/platform/vivid/vivid-vid-common.c +++ b/drivers/media/platform/vivid/vivid-vid-common.c @@ -694,6 +694,9 @@ int vivid_vid_adjust_sel(unsigned flags, struct v4l2_rect *r) unsigned w = r->width; unsigned h = r->height; + /* sanitize w and h in case someone passes ~0 as the value */ + w &= 0xffff; + h &= 0xffff; if (!(flags & V4L2_SEL_FLAG_LE)) { w++; h++; @@ -718,8 +721,9 @@ int vivid_vid_adjust_sel(unsigned flags, struct v4l2_rect *r) r->top = 0; if (r->left < 0) r->left = 0; - r->left &= ~1; - r->top &= ~1; + /* sanitize left and top in case someone passes ~0 as the value */ + r->left &= 0xfffe; + r->top &= 0xfffe; if (r->left + w > MAX_WIDTH) r->left = MAX_WIDTH - w; if (r->top + h > MAX_HEIGHT) |
