Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 480b8b3e authored by Ville Syrjälä's avatar Ville Syrjälä
Browse files

video/hdmi: Pass buffer size to infoframe unpack functions 



To make sure the infoframe unpack functions don't end up examining
stack garbage or oopsing, let's pass in the size of the buffer.

v2: Convert tda1997x.c as well (kbuild test robot)

Cc: Thierry Reding <thierry.reding@gmail.com>
Cc: Hans Verkuil <hans.verkuil@cisco.com>
Cc: linux-media@vger.kernel.org
Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180920185145.1912-3-ville.syrjala@linux.intel.com


Acked-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
parent f26e1de5

drivers/media/i2c/adv7511.c

+1 −1
Original line number Diff line number Diff line
@@ -550,7 +550,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_ 
	buffer[3] = 0;

	buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);



	if (hdmi_infoframe_unpack(&frame, buffer) < 0) {

	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {

		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);

		return;

	}

drivers/media/i2c/adv7604.c

+1 −1
Original line number Diff line number Diff line
@@ -2418,7 +2418,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index, 
		buffer[i + 3] = infoframe_read(sd,

				       adv76xx_cri[index].payload_addr + i);



	if (hdmi_infoframe_unpack(frame, buffer) < 0) {

	if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) {

		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__,

			 adv76xx_cri[index].desc);

		return -ENOENT;

drivers/media/i2c/adv7842.c

+1 −1
Original line number Diff line number Diff line
@@ -2563,7 +2563,7 @@ static void log_infoframe(struct v4l2_subdev *sd, struct adv7842_cfg_read_infofr 
	for (i = 0; i < len; i++)

		buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i);



	if (hdmi_infoframe_unpack(&frame, buffer) < 0) {

	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {

		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);

		return;

	}

drivers/media/i2c/tc358743.c

+1 −1
Original line number Diff line number Diff line
@@ -444,7 +444,7 @@ static void print_avi_infoframe(struct v4l2_subdev *sd) 


	i2c_rd(sd, PK_AVI_0HEAD, buffer, HDMI_INFOFRAME_SIZE(AVI));



	if (hdmi_infoframe_unpack(&frame, buffer) < 0) {

	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {

		v4l2_err(sd, "%s: unpack of AVI infoframe failed\n", __func__);

		return;

	}

drivers/media/i2c/tda1997x.c

+2 −2
Original line number Diff line number Diff line
@@ -1253,7 +1253,7 @@ tda1997x_parse_infoframe(struct tda1997x_state *state, u16 addr) 


	/* read data */

	len = io_readn(sd, addr, sizeof(buffer), buffer);

	err = hdmi_infoframe_unpack(&frame, buffer);

	err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer));

	if (err) {

		v4l_err(state->client,

			"failed parsing %d byte infoframe: 0x%04x/0x%02x\n",
@@ -1928,7 +1928,7 @@ static int tda1997x_log_infoframe(struct v4l2_subdev *sd, int addr) 
	/* read data */

	len = io_readn(sd, addr, sizeof(buffer), buffer);

	v4l2_dbg(1, debug, sd, "infoframe: addr=%d len=%d\n", addr, len);

	err = hdmi_infoframe_unpack(&frame, buffer);

	err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer));

	if (err) {

		v4l_err(state->client,

			"failed parsing %d byte infoframe: 0x%04x/0x%02x\n",