Skip to contentSkip to conversation

saa7146: check return value of saa7146_format_by_fourcc() to avoid NULL pointer

PATCH In review Ethan Zhao 2 participants 3 messages Jan 6, 2014 – Jan 10, 2014

Subsystems (2)
Media (V4L/DVB) SAA7146 VIDEO4LINUX-2 driver
lore
Share & tools
lore

Ethan Zhao

author
#0 lore raw

PATCH 1/1 saa7146: check return value of saa7146_format_by_fourcc() to avoid NULL pointer

Function saa7146_format_by_fourcc() may return NULL, reference of the returned result would cause NULL pointer issue without checking.

Signed-off-by Ethan Zhao <[email protected]>
---
 drivers/media/common/saa7146/saa7146_hlp.c | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)
drivers/media/common/saa7146/saa7146_hlp.c +19 -3
index be746d1..1c9518b 100644
@@ -575,6 +575,7 @@ static void saa7146_set_position(struct saa7146_dev *dev, int w_x, int w_y, int
 	 */
 	u32 base = (u32)(unsigned long)vv->ov_fb.base;
 
+	int which = 1;
 	struct	saa7146_video_dma vdma1;
 
 	/* calculate memory offsets for picture, look if we shall top-down-flip */

@@ -608,10 +609,14 @@ static void saa7146_set_position(struct saa7146_dev *dev, int w_x, int w_y, int
 		vdma1.pitch *= -1;
 	}
 
-	vdma1.base_page = sfmt->swap;
+	if (sfmt)
+		vdma1.base_page = sfmt->swap;
+	else
+		which = 0;
+
 	vdma1.num_line_byte = (vv->standard->v_field<<16)+vv->standard->h_pixels;
 
-	saa7146_write_out_dma(dev, 1, &vdma1);
+	saa7146_write_out_dma(dev, which, &vdma1);
 }
 
 static void saa7146_set_output_format(struct saa7146_dev *dev, unsigned long palette)

@@ -713,7 +718,12 @@ static int calculate_video_dma_grab_packed(struct saa7146_dev* dev, struct saa71
 	int bytesperline = buf->fmt->bytesperline;
 	enum v4l2_field field = buf->fmt->field;
 
-	int depth = sfmt->depth;
+	int depth;
+
+	if (sfmt)
+		depth = sfmt->depth;
+	else
+		return -EINVAL;
 
 	DEB_CAP("[size=%dx%d,fields=%s]\n",
 		width, height, v4l2_field_names[field]);

@@ -837,6 +847,9 @@ static int calculate_video_dma_grab_planar(struct saa7146_dev* dev, struct saa71
 	int height = buf->fmt->height;
 	enum v4l2_field field = buf->fmt->field;
 
+	if (!sfmt)
+		return -EINVAL;
+
 	BUG_ON(0 == buf->pt[0].dma);
 	BUG_ON(0 == buf->pt[1].dma);
 	BUG_ON(0 == buf->pt[2].dma);

@@ -1004,6 +1017,9 @@ void saa7146_set_capture(struct saa7146_dev *dev, struct saa7146_buf *buf, struc
 
 	DEB_CAP("buf:%p, next:%p\n", buf, next);
 
+	if (!sfmt)
+		return;
+
 	vdma1_prot_addr = saa7146_read(dev, PROT_ADDR1);
 	if( 0 == vdma1_prot_addr ) {
 		/* clear out beginning of streaming bit (rps register 0)*/
Signature · 1 line
1.8.3.4 (Apple Git-47)
#1 lore raw

Ethan,

FYI: please post such media patches to the linux-media mailinglist in the future. That way they will be picked up by patchwork and it makes handling them a lot easier.

I'm CC-ing that mailinglist in this reply so everyone can take a look at this patch.

Regards,

Hans

Quoted 72 lines · Ethan Zhao

Function saa7146_format_by_fourcc() may return NULL, reference of the returned result would cause NULL pointer issue without checking.

Signed-off-by Ethan Zhao <[email protected]>
---
 drivers/media/common/saa7146/saa7146_hlp.c | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)
drivers/media/common/saa7146/saa7146_hlp.c +19 -3
index be746d1..1c9518b 100644
@@ -575,6 +575,7 @@ static void saa7146_set_position(struct saa7146_dev *dev, int w_x, int w_y, int
 	 */
 	u32 base = (u32)(unsigned long)vv->ov_fb.base;
 
+	int which = 1;
 	struct	saa7146_video_dma vdma1;
 
 	/* calculate memory offsets for picture, look if we shall top-down-flip */

@@ -608,10 +609,14 @@ static void saa7146_set_position(struct saa7146_dev *dev, int w_x, int w_y, int
 		vdma1.pitch *= -1;
 	}
 
-	vdma1.base_page = sfmt->swap;
+	if (sfmt)
+		vdma1.base_page = sfmt->swap;
+	else
+		which = 0;
+
 	vdma1.num_line_byte = (vv->standard->v_field<<16)+vv->standard->h_pixels;
 
-	saa7146_write_out_dma(dev, 1, &vdma1);
+	saa7146_write_out_dma(dev, which, &vdma1);
 }
 
 static void saa7146_set_output_format(struct saa7146_dev *dev, unsigned long palette)

@@ -713,7 +718,12 @@ static int calculate_video_dma_grab_packed(struct saa7146_dev* dev, struct saa71
 	int bytesperline = buf->fmt->bytesperline;
 	enum v4l2_field field = buf->fmt->field;
 
-	int depth = sfmt->depth;
+	int depth;
+
+	if (sfmt)
+		depth = sfmt->depth;
+	else
+		return -EINVAL;
 
 	DEB_CAP("[size=%dx%d,fields=%s]\n",
 		width, height, v4l2_field_names[field]);

@@ -837,6 +847,9 @@ static int calculate_video_dma_grab_planar(struct saa7146_dev* dev, struct saa71
 	int height = buf->fmt->height;
 	enum v4l2_field field = buf->fmt->field;
 
+	if (!sfmt)
+		return -EINVAL;
+
 	BUG_ON(0 == buf->pt[0].dma);
 	BUG_ON(0 == buf->pt[1].dma);
 	BUG_ON(0 == buf->pt[2].dma);

@@ -1004,6 +1017,9 @@ void saa7146_set_capture(struct saa7146_dev *dev, struct saa7146_buf *buf, struc
 
 	DEB_CAP("buf:%p, next:%p\n", buf, next);
 
+	if (!sfmt)
+		return;
+
 	vdma1_prot_addr = saa7146_read(dev, PROT_ADDR1);
 	if( 0 == vdma1_prot_addr ) {
 		/* clear out beginning of streaming bit (rps register 0)*/
#2 lore raw
In reply to Ethan Zhao

Hi Ethan,

Quoted 21 lines · Ethan Zhao

Function saa7146_format_by_fourcc() may return NULL, reference of the returned result would cause NULL pointer issue without checking.

Signed-off-by Ethan Zhao <[email protected]>
---
 drivers/media/common/saa7146/saa7146_hlp.c | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)
drivers/media/common/saa7146/saa7146_hlp.c +1 -0
index be746d1..1c9518b 100644
@@ -575,6 +575,7 @@ static void saa7146_set_position(struct saa7146_dev *dev, int w_x, int w_y, int
 	 */
 	u32 base = (u32)(unsigned long)vv->ov_fb.base;
 
+	int which = 1;
 	struct	saa7146_video_dma vdma1;
 
 	/* calculate memory offsets for picture, look if we shall top-down-flip */

drivers/media/common/saa7146/saa7146_hlp.c static void saa7146_set_position(struct saa7146_dev *dev, int w_x, int w_y, int · line 615

Quoted 8 lines
drivers/media/common/saa7146/saa7146_hlp.c +4 -1
@@ -608,10 +609,14 @@ static void saa7146_set_position(struct saa7146_dev *dev, int w_x, int w_y, int
 		vdma1.pitch *= -1;
 	}
 
-	vdma1.base_page = sfmt->swap;
+	if (sfmt)
+		vdma1.base_page = sfmt->swap;
+	else
+		which = 0;

I wouldn't do this. If sfmt == NULL, then just return and do nothing. Unless there is some reason for calling saa7146_write_out_dma() anyway that I don't get?

If sfmt == NULL when you get here, then something is seriously wrong in any case.

Quoted 8 lines
drivers/media/common/saa7146/saa7146_hlp.c +1 -1
 	vdma1.num_line_byte = (vv->standard->v_field<<16)+vv->standard->h_pixels;
 
-	saa7146_write_out_dma(dev, 1, &vdma1);
+	saa7146_write_out_dma(dev, which, &vdma1);
 }
 
 static void saa7146_set_output_format(struct saa7146_dev *dev, unsigned long palette)

drivers/media/common/saa7146/saa7146_hlp.c static int calculate_video_dma_grab_packed(struct saa7146_dev* dev, struct saa71 · line 726

Quoted 10 lines
drivers/media/common/saa7146/saa7146_hlp.c +6 -1
@@ -713,7 +718,12 @@ static int calculate_video_dma_grab_packed(struct saa7146_dev* dev, struct saa71
 	int bytesperline = buf->fmt->bytesperline;
 	enum v4l2_field field = buf->fmt->field;
 
-	int depth = sfmt->depth;
+	int depth;
+
+	if (sfmt)
+		depth = sfmt->depth;
+	else
+		return -EINVAL;

I prefer this the other way around:

	if (!sfmt)
		return -EINVAL;
	depth = sfmt->depth;

It's slightly shorter and saves one indent.

Quoted 15 lines
drivers/media/common/saa7146/saa7146_hlp.c +3 -0
 	DEB_CAP("[size=%dx%d,fields=%s]\n",
 		width, height, v4l2_field_names[field]);

@@ -837,6 +847,9 @@ static int calculate_video_dma_grab_planar(struct saa7146_dev* dev, struct saa71
 	int height = buf->fmt->height;
 	enum v4l2_field field = buf->fmt->field;
 
+	if (!sfmt)
+		return -EINVAL;
+
 	BUG_ON(0 == buf->pt[0].dma);
 	BUG_ON(0 == buf->pt[1].dma);
 	BUG_ON(0 == buf->pt[2].dma);

drivers/media/common/saa7146/saa7146_hlp.c void saa7146_set_capture(struct saa7146_dev *dev, struct saa7146_buf *buf, struc · line 1025

Quoted 9 lines
drivers/media/common/saa7146/saa7146_hlp.c +3 -0
@@ -1004,6 +1017,9 @@ void saa7146_set_capture(struct saa7146_dev *dev, struct saa7146_buf *buf, struc
 
 	DEB_CAP("buf:%p, next:%p\n", buf, next);
 
+	if (!sfmt)
+		return;
+
 	vdma1_prot_addr = saa7146_read(dev, PROT_ADDR1);
 	if( 0 == vdma1_prot_addr ) {
 		/* clear out beginning of streaming bit (rps register 0)*/

Regards,

Hans