Loading msm/vidc/hfi_response_handler.c +20 −19 Original line number Diff line number Diff line Loading @@ -90,6 +90,16 @@ static int get_hal_pixel_depth(u32 hfi_bit_depth) return MSM_VIDC_BIT_DEPTH_UNSUPPORTED; } static inline int validate_pkt_size(u32 rem_size, u32 msg_size) { if (rem_size < msg_size) { dprintk(VIDC_ERR, "%s: bad_packet_size: %d\n", __func__, rem_size); return false; } return true; } static int hfi_process_sess_evt_seq_changed(u32 device_id, struct hfi_msg_event_notify_packet *pkt, struct msm_vidc_cb_info *info) Loading @@ -108,15 +118,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, int luma_bit_depth, chroma_bit_depth; struct hfi_colour_space *colour_info; #define VALIDATE_PKT_SIZE(__rem_size, __msg_size) ({ \ if (__rem_size < __msg_size) { \ dprintk(VIDC_ERR, \ "hal_process_session_init_done: bad_pkt_size\n"); \ false; \ } \ true; \ }) if (!VALIDATE_PKT_SIZE(pkt->size, if (!validate_pkt_size(pkt->size, sizeof(struct hfi_msg_event_notify_packet))) return -E2BIG; Loading @@ -142,13 +144,13 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size = pkt->size - sizeof(struct hfi_msg_event_notify_packet) + sizeof(u32); do { if (!VALIDATE_PKT_SIZE(rem_size, sizeof(u32))) if (!validate_pkt_size(rem_size, sizeof(u32))) return -E2BIG; prop_id = (int) *((u32 *)data_ptr); rem_size -= sizeof(u32); switch (prop_id) { case HFI_PROPERTY_PARAM_FRAME_SIZE: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_frame_size))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading @@ -163,7 +165,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(struct hfi_frame_size); break; case HFI_PROPERTY_PARAM_PROFILE_LEVEL_CURRENT: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_profile_level))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading @@ -179,7 +181,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(struct hfi_profile_level); break; case HFI_PROPERTY_PARAM_VDEC_PIXEL_BITDEPTH: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_bit_depth))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading Loading @@ -215,7 +217,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(struct hfi_bit_depth); break; case HFI_PROPERTY_PARAM_VDEC_PIC_STRUCT: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_pic_struct))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading @@ -230,7 +232,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(struct hfi_pic_struct); break; case HFI_PROPERTY_PARAM_VDEC_COLOUR_SPACE: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_colour_space))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading @@ -246,7 +248,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(struct hfi_colour_space); break; case HFI_PROPERTY_CONFIG_VDEC_ENTROPY: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(u32))) if (!validate_pkt_size(rem_size, sizeof(u32))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); entropy_mode = *(u32 *)data_ptr; Loading @@ -258,7 +260,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(u32); break; case HFI_PROPERTY_CONFIG_BUFFER_REQUIREMENTS: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_buffer_requirements))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading @@ -276,7 +278,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, sizeof(struct hfi_buffer_requirements); break; case HFI_INDEX_EXTRADATA_INPUT_CROP: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_index_extradata_input_crop_payload))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading Loading @@ -311,7 +313,6 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, num_properties_changed--; } while (num_properties_changed > 0); } #undef VALIDATE_PKT_SIZE info->response_type = HAL_SESSION_EVENT_CHANGE; info->response.event = event_notify; Loading Loading
msm/vidc/hfi_response_handler.c +20 −19 Original line number Diff line number Diff line Loading @@ -90,6 +90,16 @@ static int get_hal_pixel_depth(u32 hfi_bit_depth) return MSM_VIDC_BIT_DEPTH_UNSUPPORTED; } static inline int validate_pkt_size(u32 rem_size, u32 msg_size) { if (rem_size < msg_size) { dprintk(VIDC_ERR, "%s: bad_packet_size: %d\n", __func__, rem_size); return false; } return true; } static int hfi_process_sess_evt_seq_changed(u32 device_id, struct hfi_msg_event_notify_packet *pkt, struct msm_vidc_cb_info *info) Loading @@ -108,15 +118,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, int luma_bit_depth, chroma_bit_depth; struct hfi_colour_space *colour_info; #define VALIDATE_PKT_SIZE(__rem_size, __msg_size) ({ \ if (__rem_size < __msg_size) { \ dprintk(VIDC_ERR, \ "hal_process_session_init_done: bad_pkt_size\n"); \ false; \ } \ true; \ }) if (!VALIDATE_PKT_SIZE(pkt->size, if (!validate_pkt_size(pkt->size, sizeof(struct hfi_msg_event_notify_packet))) return -E2BIG; Loading @@ -142,13 +144,13 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size = pkt->size - sizeof(struct hfi_msg_event_notify_packet) + sizeof(u32); do { if (!VALIDATE_PKT_SIZE(rem_size, sizeof(u32))) if (!validate_pkt_size(rem_size, sizeof(u32))) return -E2BIG; prop_id = (int) *((u32 *)data_ptr); rem_size -= sizeof(u32); switch (prop_id) { case HFI_PROPERTY_PARAM_FRAME_SIZE: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_frame_size))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading @@ -163,7 +165,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(struct hfi_frame_size); break; case HFI_PROPERTY_PARAM_PROFILE_LEVEL_CURRENT: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_profile_level))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading @@ -179,7 +181,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(struct hfi_profile_level); break; case HFI_PROPERTY_PARAM_VDEC_PIXEL_BITDEPTH: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_bit_depth))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading Loading @@ -215,7 +217,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(struct hfi_bit_depth); break; case HFI_PROPERTY_PARAM_VDEC_PIC_STRUCT: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_pic_struct))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading @@ -230,7 +232,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(struct hfi_pic_struct); break; case HFI_PROPERTY_PARAM_VDEC_COLOUR_SPACE: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_colour_space))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading @@ -246,7 +248,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(struct hfi_colour_space); break; case HFI_PROPERTY_CONFIG_VDEC_ENTROPY: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(u32))) if (!validate_pkt_size(rem_size, sizeof(u32))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); entropy_mode = *(u32 *)data_ptr; Loading @@ -258,7 +260,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, rem_size -= sizeof(u32); break; case HFI_PROPERTY_CONFIG_BUFFER_REQUIREMENTS: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_buffer_requirements))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading @@ -276,7 +278,7 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, sizeof(struct hfi_buffer_requirements); break; case HFI_INDEX_EXTRADATA_INPUT_CROP: if (!VALIDATE_PKT_SIZE(rem_size, sizeof(struct if (!validate_pkt_size(rem_size, sizeof(struct hfi_index_extradata_input_crop_payload))) return -E2BIG; data_ptr = data_ptr + sizeof(u32); Loading Loading @@ -311,7 +313,6 @@ static int hfi_process_sess_evt_seq_changed(u32 device_id, num_properties_changed--; } while (num_properties_changed > 0); } #undef VALIDATE_PKT_SIZE info->response_type = HAL_SESSION_EVENT_CHANGE; info->response.event = event_notify; Loading