media: davinci_vpfe: fix some potential overflows

PATCH New Dan Carpenter 1 participant 1 message Apr 20, 2018

Subsystems (3)

Media (V4L/DVB) Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2018-04-20 10:09 UTC #0 lore raw

PATCH 1/1 media: davinci_vpfe: fix some potential overflows

We check "lutdpc->dpc_size" in ipipe_validate_lutdpc_params() but if it's invalid then we would have corrupted memory already when we do the memcpy() before calling it.

We don't ever check "gamma->tbl_size" but we should since they come from the user.

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/media/davinci_vpfe/dm365_ipipe.c +5 -1

index 95942768639c..068b3333e224 100644
@@ -82,6 +82,8 @@ static int ipipe_set_lutdpc_params(struct vpfe_ipipe_device *ipipe, void *param)
 	lutdpc->en = dpc_param->en;
 	lutdpc->repl_white = dpc_param->repl_white;
 	lutdpc->dpc_size = dpc_param->dpc_size;
+	if (dpc_param->dpc_size > LUT_DPC_MAX_SIZE)
+		return -EINVAL;
 	memcpy(&lutdpc->table, &dpc_param->table,
 	       (dpc_param->dpc_size * sizeof(struct vpfe_ipipe_lutdpc_entry)));
 	if (ipipe_validate_lutdpc_params(lutdpc) < 0)

@@ -591,7 +593,7 @@ ipipe_validate_gamma_entry(struct vpfe_ipipe_gamma_entry *table, int size)
 static int
 ipipe_validate_gamma_params(struct vpfe_ipipe_gamma *gamma, struct device *dev)
 {
-	int table_size;
+	unsigned int table_size;
 	int err;
 
 	if (gamma->bypass_r > 1 ||

@@ -603,6 +605,8 @@ ipipe_validate_gamma_params(struct vpfe_ipipe_gamma *gamma, struct device *dev)
 		return 0;
 
 	table_size = gamma->tbl_size;
+	if (table_size > VPFE_IPIPE_MAX_SIZE_GAMMA)
+		return -EINVAL;
 	if (!gamma->bypass_r) {
 		err = ipipe_validate_gamma_entry(gamma->table_r, table_size);
 		if (err) {