Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c6f09994 authored by Tom Rix's avatar Tom Rix Committed by Greg Kroah-Hartman
Browse files

media: video/hdmi: handle short reads of hdmi info frame. 



[ Upstream commit 4a92fc6e55da5b87cecb572275deaff6ac9dd27e ]

Calling hdmi_infoframe_unpack() with static sizeof(buffer) skips all
the size checking done later in hdmi_infoframe_unpack().  A better
value is the amount of data read into buffer.

Fixes: 480b8b3e ("video/hdmi: Pass buffer size to infoframe unpack functions")
Signed-off-by: default avatarTom Rix <trix@redhat.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent a9d0bb29

drivers/media/i2c/adv7511-v4l2.c

+1 −1
Original line number Diff line number Diff line
@@ -555,7 +555,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_ 
	buffer[3] = 0;

	buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);



	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {

	if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) {

		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);

		return;

	}

drivers/media/i2c/adv7604.c

+1 −1
Original line number Diff line number Diff line
@@ -2444,7 +2444,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index, 
		buffer[i + 3] = infoframe_read(sd,

				       adv76xx_cri[index].payload_addr + i);



	if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) {

	if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) {

		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__,

			 adv76xx_cri[index].desc);

		return -ENOENT;

drivers/media/i2c/adv7842.c

+1 −1
Original line number Diff line number Diff line
@@ -2574,7 +2574,7 @@ static void log_infoframe(struct v4l2_subdev *sd, struct adv7842_cfg_read_infofr 
	for (i = 0; i < len; i++)

		buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i);



	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {

	if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) {

		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);

		return;

	}