2013-10-13 10:16:37

by Roel Kluin

Subject: exynos4: index out of bounds if no pixelcode found

In case no valid pixelcode is found, an i of -1 after the loop is out of
bounds for the array.

Signed-off-by: Roel Kluin <[email protected]>
---
diff --git a/drivers/media/platform/exynos4-is/fimc-lite-reg.c
b/drivers/media/platform/exynos4-is/fimc-lite-reg.c
index 72a343e3b..d0dc7ee 100644
--- a/drivers/media/platform/exynos4-is/fimc-lite-reg.c
+++ b/drivers/media/platform/exynos4-is/fimc-lite-reg.c
@@ -133,7 +133,7 @@ void flite_hw_set_source_format(struct fimc_lite *dev,
struct flite_frame *f)
int i = ARRAY_SIZE(src_pixfmt_map);
u32 cfg;

- while (--i >= 0) {
+ while (--i) {
if (src_pixfmt_map[i][0] == pixelcode)
break;
}
@@ -240,7 +240,7 @@ static void flite_hw_set_out_order(struct fimc_lite
*dev, struct flite_frame *f)
u32 cfg = readl(dev->regs + FLITE_REG_CIODMAFMT);
int i = ARRAY_SIZE(pixcode);

- while (--i >= 0)
+ while (--i)
if (pixcode[i][0] == f->fmt->mbus_code)
break;
cfg &= ~FLITE_REG_CIODMAFMT_YCBCR_ORDER_MASK;

2013-10-13 11:13:29

by Sylwester Nawrocki

Subject: Re: exynos4: index out of bounds if no pixelcode found

Hi Roel,

On 10/13/2013 12:16 PM, Roel Kluin wrote:
> In case no valid pixelcode is found, an i of -1 after the loop is out of
> bounds for the array.
>
> Signed-off-by: Roel Kluin<[email protected]>

Thank you for the fix, I have applied this patch to my tree for 3.13.
However it seems to be mangled (at least line wrapped) and didn't
apply cleanly. The patchwork also didn't catch it properly:
https://patchwork.linuxtv.org/patch/20380/

I'd suggest using git send-email in future.

Thanks,
Sylwester