vivid: sanatize selection rectangle

PATCH New Hans Verkuil 1 participant 1 message Mar 15, 2015 Media (V4L/DVB)

Share & tools

Hans Verkuil

author

2015-03-15 16:42 UTC #0 lore raw

PATCH 1/1 vivid: sanatize selection rectangle

Handle values like ~0 as width, height, left or top fields. Just strip off the top 16 bits will ensure that the calculations remain OK.

Found with v4l2-compliance.

Signed-off-by Hans Verkuil <[email protected]>

---
 drivers/media/platform/vivid/vivid-vid-common.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

drivers/media/platform/vivid/vivid-vid-common.c +6 -2

index 283b2e8..53f0c1d 100644
@@ -694,6 +694,9 @@ int vivid_vid_adjust_sel(unsigned flags, struct v4l2_rect *r)
 	unsigned w = r->width;
 	unsigned h = r->height;
 
+	/* sanitize w and h in case someone passes ~0 as the value */
+	w &= 0xffff;
+	h &= 0xffff;
 	if (!(flags & V4L2_SEL_FLAG_LE)) {
 		w++;
 		h++;

@@ -718,8 +721,9 @@ int vivid_vid_adjust_sel(unsigned flags, struct v4l2_rect *r)
 		r->top = 0;
 	if (r->left < 0)
 		r->left = 0;
-	r->left &= ~1;
-	r->top &= ~1;
+	/* sanitize left and top in case someone passes ~0 as the value */
+	r->left &= 0xfffe;
+	r->top &= 0xfffe;
 	if (r->left + w > MAX_WIDTH)
 		r->left = MAX_WIDTH - w;
 	if (r->top + h > MAX_HEIGHT)

Signature · 1 line

2.1.4