Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a5ae2062 authored by Jean-Francois Moine's avatar Jean-Francois Moine Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (8195): gspca: Input buffer overwritten in spca561 + cleanup code. 



spca561:  Input buffer may be changed on reg write.
(all sd): Cleanup code, 'const' added.

Signed-off-by: default avatarJean-Francois Moine <moinejf@free.fr>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@infradead.org>
parent 54ab92ca

drivers/media/video/gspca/conex.c

+52 −46
Original line number Diff line number Diff line
@@ -25,8 +25,8 @@ 
#define CONEX_CAM 1		/* special JPEG header */

#include "jpeg.h"



#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 3)

static const char version[] = "2.1.3";

#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 4)

static const char version[] = "2.1.4";



MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");

MODULE_DESCRIPTION("GSPCA USB Conexant Camera Driver");
@@ -229,7 +229,7 @@ static void cx11646_fw(struct gspca_dev*gspca_dev) 
	reg_w(gspca_dev->dev, 0x006a, &val, 1);

}



static __u8 cxsensor[] = {

static const __u8 cxsensor[] = {

	0x88, 0x12, 0x70, 0x01,

	0x88, 0x0d, 0x02, 0x01,

	0x88, 0x0f, 0x00, 0x01,
@@ -244,24 +244,24 @@ static __u8 cxsensor[] = { 
	0x00

};



static __u8 reg20[] = { 0x10, 0x42, 0x81, 0x19, 0xd3, 0xff, 0xa7, 0xff };

static __u8 reg28[] = { 0x87, 0x00, 0x87, 0x00, 0x8f, 0xff, 0xea, 0xff };

static __u8 reg10[] = { 0xb1, 0xb1 };

static __u8 reg71a[] = { 0x08, 0x18, 0x0a, 0x1e };	/* 640 */

static __u8 reg71b[] = { 0x04, 0x0c, 0x05, 0x0f };

static const __u8 reg20[] = { 0x10, 0x42, 0x81, 0x19, 0xd3, 0xff, 0xa7, 0xff };

static const __u8 reg28[] = { 0x87, 0x00, 0x87, 0x00, 0x8f, 0xff, 0xea, 0xff };

static const __u8 reg10[] = { 0xb1, 0xb1 };

static const __u8 reg71a[] = { 0x08, 0x18, 0x0a, 0x1e };	/* 640 */

static const __u8 reg71b[] = { 0x04, 0x0c, 0x05, 0x0f };

	/* 352{0x04,0x0a,0x06,0x12}; //352{0x05,0x0e,0x06,0x11}; //352 */

static __u8 reg71c[] = { 0x02, 0x07, 0x03, 0x09 };

static const __u8 reg71c[] = { 0x02, 0x07, 0x03, 0x09 };

					/* 320{0x04,0x0c,0x05,0x0f}; //320 */

static __u8 reg71d[] = { 0x02, 0x07, 0x03, 0x09 };	/* 176 */

static __u8 reg7b[] = { 0x00, 0xff, 0x00, 0xff, 0x00, 0xff };

static const __u8 reg71d[] = { 0x02, 0x07, 0x03, 0x09 };	/* 176 */

static const __u8 reg7b[] = { 0x00, 0xff, 0x00, 0xff, 0x00, 0xff };



static void cx_sensor(struct gspca_dev*gspca_dev)

{

	__u8 val = 0;

	__u8 val;

	int i = 0;

	__u8 bufread[] = { 0, 0, 0, 0, 0, 0, 0, 0 };

	int length = 0;

	__u8 *ptsensor = cxsensor;

	int length;

	const __u8 *ptsensor = cxsensor;



	reg_w(gspca_dev->dev, 0x0020, reg20, 8);

	reg_w(gspca_dev->dev, 0x0028, reg28, 8);
@@ -305,7 +305,7 @@ static void cx_sensor(struct gspca_dev*gspca_dev) 
	reg_r(gspca_dev->dev, 0x00e7, bufread, 8);

}



static __u8 cx_inits_176[] = {

static const __u8 cx_inits_176[] = {

	0x33, 0x81, 0xB0, 0x00, 0x90, 0x00, 0x0A, 0x03,	/* 176x144 */

	0x00, 0x03, 0x03, 0x03, 0x1B, 0x05, 0x30, 0x03,

	0x65, 0x15, 0x18, 0x25, 0x03, 0x25, 0x08, 0x30,
@@ -314,7 +314,7 @@ static __u8 cx_inits_176[] = { 
	0xF7, 0xFF, 0x88, 0xFF, 0x66, 0x02, 0x28, 0x02,

	0x1E, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00

};

static __u8 cx_inits_320[] = {

static const __u8 cx_inits_320[] = {

	0x7f, 0x7f, 0x40, 0x01, 0xf0, 0x00, 0x02, 0x01,

	0x00, 0x01, 0x01, 0x01, 0x10, 0x00, 0x02, 0x01,

	0x65, 0x45, 0xfa, 0x4c, 0x2c, 0xdf, 0xb9, 0x81,
@@ -323,7 +323,7 @@ static __u8 cx_inits_320[] = { 
	0xf5, 0xff, 0x6d, 0xff, 0xf6, 0x01, 0x43, 0x02,

	0xd3, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00

};

static __u8 cx_inits_352[] = {

static const __u8 cx_inits_352[] = {

	0x2e, 0x7c, 0x60, 0x01, 0x20, 0x01, 0x05, 0x03,

	0x00, 0x06, 0x03, 0x06, 0x1b, 0x10, 0x05, 0x3b,

	0x30, 0x25, 0x18, 0x25, 0x08, 0x30, 0x03, 0x25,
@@ -332,7 +332,7 @@ static __u8 cx_inits_352[] = { 
	0xf5, 0xff, 0x6b, 0xff, 0xee, 0x01, 0x43, 0x02,

	0xe4, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00

};

static __u8 cx_inits_640[] = {

static const __u8 cx_inits_640[] = {

	0x7e, 0x7e, 0x80, 0x02, 0xe0, 0x01, 0x01, 0x01,

	0x00, 0x02, 0x01, 0x02, 0x10, 0x30, 0x01, 0x01,

	0x65, 0x45, 0xf7, 0x52, 0x2c, 0xdf, 0xb9, 0x81,
@@ -344,7 +344,7 @@ static __u8 cx_inits_640[] = { 


static int cx11646_initsize(struct gspca_dev *gspca_dev)

{

	__u8 *cxinit;

	const __u8 *cxinit;

	__u8 val;

	static const __u8 reg12[] = { 0x08, 0x05, 0x07, 0x04, 0x24 };

	static const __u8 reg17[] =
@@ -396,7 +396,7 @@ static int cx11646_initsize(struct gspca_dev *gspca_dev) 
	return val;

}



static __u8 cx_jpeg_init[][8] = {

static const __u8 cx_jpeg_init[][8] = {

	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x15},	/* 1 */

	{0x0f, 0x10, 0x12, 0x10, 0x0d, 0x15, 0x12, 0x11},

	{0x12, 0x18, 0x16, 0x15, 0x19, 0x20, 0x35, 0x22},
@@ -479,7 +479,7 @@ static __u8 cx_jpeg_init[][8] = { 
};





static __u8 cxjpeg_640[][8] = {

static const __u8 cxjpeg_640[][8] = {

	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x10},	/* 1 */

	{0x0b, 0x0c, 0x0e, 0x0c, 0x0a, 0x10, 0x0e, 0x0d},

	{0x0e, 0x12, 0x11, 0x10, 0x13, 0x18, 0x28, 0x1a},
@@ -508,7 +508,7 @@ static __u8 cxjpeg_640[][8] = { 
	{0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},

	{0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}	/* 27 */

};

static __u8 cxjpeg_352[][8] = {

static const __u8 cxjpeg_352[][8] = {

	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x0d},

	{0x09, 0x09, 0x0b, 0x09, 0x08, 0x0D, 0x0b, 0x0a},

	{0x0b, 0x0e, 0x0d, 0x0d, 0x0f, 0x13, 0x1f, 0x14},
@@ -537,7 +537,7 @@ static __u8 cxjpeg_352[][8] = { 
	{0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},

	{0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}

};

static __u8 cxjpeg_320[][8] = {

static const __u8 cxjpeg_320[][8] = {

	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x05},

	{0x03, 0x04, 0x04, 0x04, 0x03, 0x05, 0x04, 0x04},

	{0x04, 0x05, 0x05, 0x05, 0x06, 0x07, 0x0c, 0x08},
@@ -566,7 +566,7 @@ static __u8 cxjpeg_320[][8] = { 
	{0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},

	{0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}	/* 27 */

};

static __u8 cxjpeg_176[][8] = {

static const __u8 cxjpeg_176[][8] = {

	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x0d},

	{0x09, 0x09, 0x0B, 0x09, 0x08, 0x0D, 0x0B, 0x0A},

	{0x0B, 0x0E, 0x0D, 0x0D, 0x0F, 0x13, 0x1F, 0x14},
@@ -595,7 +595,8 @@ static __u8 cxjpeg_176[][8] = { 
	{0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},

	{0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}

};

static __u8 cxjpeg_qtable[][8] = {	/* 640 take with the zcx30x part */

/* 640 take with the zcx30x part */

static const __u8 cxjpeg_qtable[][8] = {

	{0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x08},

	{0x06, 0x06, 0x07, 0x06, 0x05, 0x08, 0x07, 0x07},

	{0x07, 0x09, 0x09, 0x08, 0x0a, 0x0c, 0x14, 0x0a},
@@ -641,22 +642,23 @@ static void cx11646_jpegInit(struct gspca_dev*gspca_dev) 
	reg_w(gspca_dev->dev, 0x0055, &val, 1);

}



static __u8 reg12[] = { 0x0a, 0x05, 0x07, 0x04, 0x19 };

static __u8 regE5_8[] = { 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };

static __u8 regE5a[] = { 0x88, 0x0a, 0x0c, 0x01 };

static __u8 regE5b[] = { 0x88, 0x0b, 0x12, 0x01 };

static __u8 regE5c[] = { 0x88, 0x05, 0x01, 0x01 };

static __u8 reg51[] = { 0x77, 0x03 };

static __u8 reg70 = 0x03;

static const __u8 reg12[] = { 0x0a, 0x05, 0x07, 0x04, 0x19 };

static const __u8 regE5_8[] =

		{ 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };

static const __u8 regE5a[] = { 0x88, 0x0a, 0x0c, 0x01 };

static const __u8 regE5b[] = { 0x88, 0x0b, 0x12, 0x01 };

static const __u8 regE5c[] = { 0x88, 0x05, 0x01, 0x01 };

static const __u8 reg51[] = { 0x77, 0x03 };

static const __u8 reg70 = 0x03;



static void cx11646_jpeg(struct gspca_dev*gspca_dev)

{

	__u8 val;

	int i;

	int length = 8;

	__u8 Reg55 = 0x14;

	__u8 bufread[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };

	int retry = 50;

	int length;

	__u8 Reg55;

	__u8 bufread[8];

	int retry;



	val = 0x01;

	reg_w(gspca_dev->dev, 0x00c0, &val, 1);
@@ -665,6 +667,7 @@ static void cx11646_jpeg(struct gspca_dev*gspca_dev) 
	val = 0x00;

	reg_w(gspca_dev->dev, 0x00c0, &val, 1);

	reg_r(gspca_dev->dev, 0x0001, &val, 1);

	length = 8;

	switch (gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].mode) {

	case 0:

		for (i = 0; i < 27; i++) {
@@ -719,6 +722,7 @@ static void cx11646_jpeg(struct gspca_dev*gspca_dev) 
	val = 0x00;

	reg_w(gspca_dev->dev, 0x0000, &val, 1);

	/* wait for completion */

	retry = 50;

	while (retry--) {

		reg_r(gspca_dev->dev, 0x0002, &val, 1);

							/* 0x07 until 0x00 */
@@ -827,7 +831,7 @@ static int sd_config(struct gspca_dev *gspca_dev, 
	cam->cam_mode = vga_mode;

	cam->nmodes = sizeof vga_mode / sizeof vga_mode[0];



	sd->qindex = 0;			/* set the quantization table */

	sd->qindex = 0;			/* set the quantization */

	sd->brightness = sd_ctrls[SD_BRIGHTNESS].qctrl.default_value;

	sd->contrast = sd_ctrls[SD_CONTRAST].qctrl.default_value;

	sd->colors = sd_ctrls[SD_COLOR].qctrl.default_value;
@@ -891,7 +895,7 @@ static void sd_close(struct gspca_dev *gspca_dev) 


static void sd_pkt_scan(struct gspca_dev *gspca_dev,

			struct gspca_frame *frame,	/* target */

			unsigned char *data,		/* isoc packet */

			__u8 *data,			/* isoc packet */

			int len)			/* iso packet length */

{

	if (data[0] == 0xff && data[1] == 0xd8) {
@@ -914,21 +918,22 @@ static void setbrightness(struct gspca_dev*gspca_dev) 
{

	struct sd *sd = (struct sd *) gspca_dev;

	__u8 regE5cbx[] = { 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };

	__u8 reg51c[] = { 0x77, 0x03 };

	__u8 reg51c[2];

	__u8 bright;

	__u8 colors;

	__u8 val;

	__u8 bufread[8];



	bright = sd->brightness;

	colors = sd->colors;

	regE5cbx[2] = bright;

	reg51c[1] = colors;

	reg_w(gspca_dev->dev, 0x00e5, regE5cbx, 8);

	reg_r(gspca_dev->dev, 0x00e8, bufread, 8);

	reg_w(gspca_dev->dev, 0x00e5, regE5c, 4);

	reg_r(gspca_dev->dev, 0x00e8, &val, 1);	/* 0x00 */



	colors = sd->colors;

	reg51c[0] = 0x77;

	reg51c[1] = colors;

	reg_w(gspca_dev->dev, 0x0051, reg51c, 2);

	reg_w(gspca_dev->dev, 0x0010, reg10, 2);

	reg_w(gspca_dev->dev, 0x0070, &reg70, 1);
@@ -938,14 +943,15 @@ static void setcontrast(struct gspca_dev*gspca_dev) 
{

	struct sd *sd = (struct sd *) gspca_dev;

	__u8 regE5acx[] = { 0x88, 0x0a, 0x0c, 0x01 };	/* seem MSB */

	/* __u8 regE5bcx[]={0x88,0x0b,0x12,0x01}; // LSB */

	__u8 reg51c[] = { 0x77, 0x03 };

/*	__u8 regE5bcx[] = { 0x88, 0x0b, 0x12, 0x01};	 * LSB */

	__u8 reg51c[2];

	__u8 val;



	reg51c[1] = sd->colors;

	regE5acx[2] = sd->contrast;

	reg_w(gspca_dev->dev, 0x00e5, regE5acx, 4);

	reg_r(gspca_dev->dev, 0x00e8, &val, 1);	/* 0x00 */

	reg51c[0] = 0x77;

	reg51c[1] = sd->colors;

	reg_w(gspca_dev->dev, 0x0051, reg51c, 2);

	reg_w(gspca_dev->dev, 0x0010, reg10, 2);

	reg_w(gspca_dev->dev, 0x0070, &reg70, 1);

drivers/media/video/gspca/etoms.c

+209 −337

File changed.

Preview size limit exceeded, changes collapsed.

drivers/media/video/gspca/gspca.c

+3 −3
Original line number Diff line number Diff line
@@ -247,7 +247,7 @@ static void isoc_transfer(struct gspca_dev *gspca_dev) 
struct gspca_frame *gspca_frame_add(struct gspca_dev *gspca_dev,

				    int packet_type,

				    struct gspca_frame *frame,

				    __u8 *data,

				    const __u8 *data,

				    int len)

{

	int i, j;
@@ -1053,7 +1053,7 @@ static int vidioc_s_ctrl(struct file *file, void *priv, 
			 struct v4l2_control *ctrl)

{

	struct gspca_dev *gspca_dev = priv;

	struct ctrl *ctrls;

	const struct ctrl *ctrls;

	int i, ret;



	for (i = 0, ctrls = gspca_dev->sd_desc->ctrls;
@@ -1079,7 +1079,7 @@ static int vidioc_g_ctrl(struct file *file, void *priv, 
{

	struct gspca_dev *gspca_dev = priv;



	struct ctrl *ctrls;

	const struct ctrl *ctrls;

	int i, ret;



	for (i = 0, ctrls = gspca_dev->sd_desc->ctrls;

drivers/media/video/gspca/gspca.h

+3 −23
Original line number Diff line number Diff line
@@ -9,25 +9,6 @@ 
#include <media/v4l2-common.h>

#include <linux/mutex.h>



/* values in 2.6.27 */

#ifndef V4L2_PIX_FMT_SPCA501

#define V4L2_PIX_FMT_SPCA501 v4l2_fourcc('S', '5', '0', '1')

#endif

#ifndef V4L2_PIX_FMT_SPCA561

#define V4L2_PIX_FMT_SPCA561 v4l2_fourcc('S', '5', '6', '1')

#endif



/* values in 2.6.26 */

#ifndef V4L2_CID_POWER_LINE_FREQUENCY

#define V4L2_CID_POWER_LINE_FREQUENCY  (V4L2_CID_BASE+24)

#endif

#ifndef V4L2_CID_WHITE_BALANCE_TEMPERATURE

#define V4L2_CID_WHITE_BALANCE_TEMPERATURE (V4L2_CID_BASE + 26)

#endif

#ifndef V4L2_CID_SHARPNESS

#define V4L2_CID_SHARPNESS  (V4L2_CID_BASE+27)

#endif



#ifdef CONFIG_VIDEO_ADV_DEBUG

/* GSPCA our debug messages */

extern int gspca_debug;
@@ -76,7 +57,6 @@ struct cam_mode { 
	short width;

	short height;

	short mode;		/* subdriver value */

	short reserved;		/* subdriver value */

};

struct cam {

	char *dev_name;
@@ -110,9 +90,9 @@ struct ctrl { 
/* subdriver description */

struct sd_desc {

/* information */

	char *name;		/* sub-driver name */

	const char *name;	/* sub-driver name */

/* controls */

	struct ctrl *ctrls;

	const struct ctrl *ctrls;

	int nctrls;

/* operations */

	cam_cf_op config;	/* called on probe */
@@ -195,6 +175,6 @@ void gspca_disconnect(struct usb_interface *intf); 
struct gspca_frame *gspca_frame_add(struct gspca_dev *gspca_dev,

				    int packet_type,

				    struct gspca_frame *frame,

				    __u8 *data,

				    const __u8 *data,

				    int len);

#endif /* GSPCAV2_H */

drivers/media/video/gspca/mars.c

+7 −6
Original line number Diff line number Diff line
@@ -24,8 +24,8 @@ 
#include "gspca.h"

#include "jpeg.h"



#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 0)

static const char version[] = "2.1.0";

#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 1, 4)

static const char version[] = "2.1.4";



MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");

MODULE_DESCRIPTION("GSPCA/Mars USB Camera Driver");
@@ -141,6 +141,7 @@ static void sd_start(struct gspca_dev *gspca_dev) 
	int h_size, v_size;

	int intpipe;

/*	struct usb_device *dev = pcam->dev; */



	memset(data, 0, sizeof data);

	memset(MI_buf, 0, sizeof MI_buf);
@@ -351,7 +352,7 @@ static void sd_close(struct gspca_dev *gspca_dev) 


static void sd_pkt_scan(struct gspca_dev *gspca_dev,

			struct gspca_frame *frame,	/* target */

			unsigned char *data,		/* isoc packet */

			__u8 *data,			/* isoc packet */

			int len)			/* iso packet length */

{

	struct sd *sd = (struct sd *) gspca_dev;
@@ -389,7 +390,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev, 
}



/* sub-driver description */

static struct sd_desc sd_desc = {

static const struct sd_desc sd_desc = {

	.name = MODULE_NAME,

	.ctrls = sd_ctrls,

	.nctrls = ARRAY_SIZE(sd_ctrls),
@@ -404,7 +405,7 @@ static struct sd_desc sd_desc = { 


/* -- module initialisation -- */

#define DVNM(name) .driver_info = (kernel_ulong_t) name

static __devinitdata struct usb_device_id device_table[] = {

static const __devinitdata struct usb_device_id device_table[] = {

	{USB_DEVICE(0x093a, 0x050f), DVNM("Mars-Semi Pc-Camera")},

	{}

};