Commit 5ac417ef authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab

[media] sh_vou: avoid going past arrays

Smatch reports two issues:
	drivers/media/platform/sh_vou.c:670 vou_adjust_output() error: buffer overflow 'vou_scale_v_num' 3 <= 4
	drivers/media/platform/sh_vou.c:670 vou_adjust_output() error: buffer overflow 'vou_scale_v_den' 3 <= 4

It seems that there's actually a bug here: the same var (idx) is used
as an index for vertical and horizontal scaling arrays. However,
there are 4 elements on the h arrays, and only 3 at the v ones.

On the first loop, it may select index 4 for the horizontal array.

In this case, if the second loop fails to select an index, the
code would keep using 4 for the vertical array, with is past of
the array sizes.

The intent here seems to use index 0, if the scale is not found.

So, use a separate var for the vertical index.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent 7fdc5561
...@@ -600,7 +600,7 @@ static void vou_adjust_output(struct sh_vou_geometry *geo, v4l2_std_id std) ...@@ -600,7 +600,7 @@ static void vou_adjust_output(struct sh_vou_geometry *geo, v4l2_std_id std)
{ {
unsigned int best_err = UINT_MAX, best = geo->in_width, unsigned int best_err = UINT_MAX, best = geo->in_width,
width_max, height_max, img_height_max; width_max, height_max, img_height_max;
int i, idx = 0; int i, idx_h = 0, idx_v = 0;
if (std & V4L2_STD_525_60) { if (std & V4L2_STD_525_60) {
width_max = 858; width_max = 858;
...@@ -625,7 +625,7 @@ static void vou_adjust_output(struct sh_vou_geometry *geo, v4l2_std_id std) ...@@ -625,7 +625,7 @@ static void vou_adjust_output(struct sh_vou_geometry *geo, v4l2_std_id std)
err = abs(found - geo->output.width); err = abs(found - geo->output.width);
if (err < best_err) { if (err < best_err) {
best_err = err; best_err = err;
idx = i; idx_h = i;
best = found; best = found;
} }
if (!err) if (!err)
...@@ -633,12 +633,12 @@ static void vou_adjust_output(struct sh_vou_geometry *geo, v4l2_std_id std) ...@@ -633,12 +633,12 @@ static void vou_adjust_output(struct sh_vou_geometry *geo, v4l2_std_id std)
} }
geo->output.width = best; geo->output.width = best;
geo->scale_idx_h = idx; geo->scale_idx_h = idx_h;
if (geo->output.left + best > width_max) if (geo->output.left + best > width_max)
geo->output.left = width_max - best; geo->output.left = width_max - best;
pr_debug("%s(): W %u * %u/%u = %u\n", __func__, geo->in_width, pr_debug("%s(): W %u * %u/%u = %u\n", __func__, geo->in_width,
vou_scale_h_num[idx], vou_scale_h_den[idx], best); vou_scale_h_num[idx_h], vou_scale_h_den[idx_h], best);
best_err = UINT_MAX; best_err = UINT_MAX;
...@@ -655,7 +655,7 @@ static void vou_adjust_output(struct sh_vou_geometry *geo, v4l2_std_id std) ...@@ -655,7 +655,7 @@ static void vou_adjust_output(struct sh_vou_geometry *geo, v4l2_std_id std)
err = abs(found - geo->output.height); err = abs(found - geo->output.height);
if (err < best_err) { if (err < best_err) {
best_err = err; best_err = err;
idx = i; idx_v = i;
best = found; best = found;
} }
if (!err) if (!err)
...@@ -663,12 +663,12 @@ static void vou_adjust_output(struct sh_vou_geometry *geo, v4l2_std_id std) ...@@ -663,12 +663,12 @@ static void vou_adjust_output(struct sh_vou_geometry *geo, v4l2_std_id std)
} }
geo->output.height = best; geo->output.height = best;
geo->scale_idx_v = idx; geo->scale_idx_v = idx_v;
if (geo->output.top + best > height_max) if (geo->output.top + best > height_max)
geo->output.top = height_max - best; geo->output.top = height_max - best;
pr_debug("%s(): H %u * %u/%u = %u\n", __func__, geo->in_height, pr_debug("%s(): H %u * %u/%u = %u\n", __func__, geo->in_height,
vou_scale_v_num[idx], vou_scale_v_den[idx], best); vou_scale_v_num[idx_v], vou_scale_v_den[idx_v], best);
} }
static int sh_vou_s_fmt_vid_out(struct file *file, void *priv, static int sh_vou_s_fmt_vid_out(struct file *file, void *priv,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment