Commit 62599316 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab
Browse files

media: atomisp: Fix a buffer overflow in debug code 



The "pad" variable is a user controlled string and we haven't properly
clamped it at this point so the debug code could print from beyond the
of the array.

Fixes: a49d2536 ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 7072db89

drivers/staging/media/atomisp/pci/atomisp_subdev.c

+16 −8
Original line number Diff line number Diff line
@@ -349,13 +349,21 @@ static int isp_subdev_get_selection(struct v4l2_subdev *sd, 
	return 0;

}



static char *atomisp_pad_str[] = { "ATOMISP_SUBDEV_PAD_SINK",

static const char *atomisp_pad_str(unsigned int pad)

{

	static const char *const pad_str[] = {

		"ATOMISP_SUBDEV_PAD_SINK",

		"ATOMISP_SUBDEV_PAD_SOURCE_CAPTURE",

		"ATOMISP_SUBDEV_PAD_SOURCE_VF",

		"ATOMISP_SUBDEV_PAD_SOURCE_PREVIEW",

				   "ATOMISP_SUBDEV_PAD_SOURCE_VIDEO"

		"ATOMISP_SUBDEV_PAD_SOURCE_VIDEO",

	};



	if (pad >= ARRAY_SIZE(pad_str))

		return "ATOMISP_INVALID_PAD";

	return pad_str[pad];

}



int atomisp_subdev_set_selection(struct v4l2_subdev *sd,

				 struct v4l2_subdev_pad_config *cfg,

				 u32 which, uint32_t pad, uint32_t target,
@@ -378,7 +386,7 @@ int atomisp_subdev_set_selection(struct v4l2_subdev *sd, 


	dev_dbg(isp->dev,

		"sel: pad %s tgt %s l %d t %d w %d h %d which %s f 0x%8.8x\n",

		atomisp_pad_str[pad], target == V4L2_SEL_TGT_CROP

		atomisp_pad_str(pad), target == V4L2_SEL_TGT_CROP

		? "V4L2_SEL_TGT_CROP" : "V4L2_SEL_TGT_COMPOSE",

		r->left, r->top, r->width, r->height,

		which == V4L2_SUBDEV_FORMAT_TRY ? "V4L2_SUBDEV_FORMAT_TRY"
@@ -612,7 +620,7 @@ void atomisp_subdev_set_ffmt(struct v4l2_subdev *sd, 
	enum atomisp_input_stream_id stream_id;



	dev_dbg(isp->dev, "ffmt: pad %s w %d h %d code 0x%8.8x which %s\n",

		atomisp_pad_str[pad], ffmt->width, ffmt->height, ffmt->code,

		atomisp_pad_str(pad), ffmt->width, ffmt->height, ffmt->code,

		which == V4L2_SUBDEV_FORMAT_TRY ? "V4L2_SUBDEV_FORMAT_TRY"

		: "V4L2_SUBDEV_FORMAT_ACTIVE");