Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 67e86524 authored by Guennadi Liakhovetski's avatar Guennadi Liakhovetski Committed by Mauro Carvalho Chehab
Browse files

[media] V4L: mx2-camera: avoid overflowing 32-bits 



In mx2_camera_try_fmt(), when applying i.MX25 restrictions to frame sizes,
the height is checked to be <= 0xffff. But later an integer multiplication
height * 4 * 0x3ffff is performed, which will overflow even for bounded
height values. This patch switches to using 64-bit multiplication and
division to avoid overflowing.

Signed-off-by: default avatarGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent fc13baff

drivers/media/video/mx2_camera.c

+3 −2
Original line number Original line Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <linux/gcd.h>

#include <linux/gcd.h>

#include <linux/interrupt.h>

#include <linux/interrupt.h>

#include <linux/kernel.h>

#include <linux/kernel.h>

#include <linux/math64.h>

#include <linux/mm.h>

#include <linux/mm.h>

#include <linux/moduleparam.h>

#include <linux/moduleparam.h>

#include <linux/time.h>

#include <linux/time.h>
@@ -1400,8 +1401,8 @@ static int mx2_camera_try_fmt(struct soc_camera_device *icd, 
		/* Check against the CSIRXCNT limit */

		/* Check against the CSIRXCNT limit */

		if (pix->sizeimage > 4 * 0x3ffff) {

		if (pix->sizeimage > 4 * 0x3ffff) {

			/* Adjust geometry, preserve aspect ratio */

			/* Adjust geometry, preserve aspect ratio */

			unsigned int new_height = int_sqrt(4 * 0x3ffff *

			unsigned int new_height = int_sqrt(div_u64(0x3ffffULL *

					pix->height / pix->bytesperline);

					4 * pix->height, pix->bytesperline));

			pix->width = new_height * pix->width / pix->height;

			pix->width = new_height * pix->width / pix->height;

			pix->height = new_height;

			pix->height = new_height;

			pix->bytesperline = soc_mbus_bytes_per_line(pix->width,

			pix->bytesperline = soc_mbus_bytes_per_line(pix->width,