media: atomisp2: array underflow in ap1302_enum_frame_size()

Dan Carpenter · mchehab · commit 115b7ac211d1 · 2017-07-26T08:25:25.000-04:00
The problem is this code from ap1302_enum_frame_size(): 738 int index = fse->index; 739 740 mutex_lock(&dev->input_lock); 741 context = ap1302_get_context(sd); 742 if (index >= dev->cntx_res[context].res_num) { 743 mutex_unlock(&dev->input_lock); 744 return -EINVAL; 745 } 746 747 res_table = dev->cntx_res[context].res_table; 748 fse->min_width = res_table[index].width; "fse->index" is a u32 that come from the user. We want negative values of "index" to be treated as -EINVAL but they're not so we can read from before the start of the res_table[] array. I've fixed this by making "res_num" a u32. I made "cur_res" a u32 as well, just for consistency. Fixes: a49d253 ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
diff --git a/drivers/staging/media/atomisp/i2c/ap1302.h b/drivers/staging/media/atomisp/i2c/ap1302.h
@@ -158,8 +158,8 @@ struct ap1302_res_struct {
 };
 
 struct ap1302_context_res {
-	s32 res_num;
-	s32 cur_res;
+	u32 res_num;
+	u32 cur_res;
 	struct ap1302_res_struct *res_table;
 };
 
