Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Mirela Rabulea (OSS)" <mirela.rabulea@oss.nxp.com>
To:     mchehab@kernel.org, hverkuil-cisco@xs4all.nl, shawnguo@kernel.org,
        robh+dt@kernel.org
Cc:     paul.kocialkowski@bootlin.com, linux-media@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-imx@nxp.com,
        s.hauer@pengutronix.de, aisheng.dong@nxp.com,
        daniel.baluta@nxp.com, robert.chiras@nxp.com,
        laurentiu.palcu@nxp.com, mark.rutland@arm.com,
        devicetree@vger.kernel.org, p.zabel@pengutronix.de,
        ezequiel@collabora.com, laurent.pinchart+renesas@ideasonboard.com,
        niklas.soderlund+renesas@ragnatech.se,
        dafna.hirschfeld@collabora.com,
        Mirela Rabulea <mirela.rabulea@nxp.com>
Subject: [PATCH v4 09/11] media: Quit parsing stream if doesn't start with SOI
Date:   Mon,  2 Nov 2020 05:08:19 +0200
Message-Id: <20201102030821.3049-10-mirela.rabulea@oss.nxp.com>
In-Reply-To: <20201102030821.3049-1-mirela.rabulea@oss.nxp.com>
References: <20201102030821.3049-1-mirela.rabulea@oss.nxp.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from fsr-ub1664-134.ea.freescale.net (86.124.170.94) by AM0PR06CA0128.eurprd06.prod.outlook.com (2603:10a6:208:ab::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3499.19 via Frontend Transport; Mon, 2 Nov 2020 03:10:08 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: b8a7d44d-3589-449f-f9c6-08d87edcce6e
X-MS-TrafficTypeDiagnostic: AM6PR04MB5173:
X-MS-Exchange-SharedMailbox-RoutingAgent-Processed: True
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <AM6PR04MB51735A0DC45CE1EE2492499FCE100@AM6PR04MB5173.eurprd04.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:5236;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: XOVY8vnSsvw32IhQDpHJv2Gji7TQH1UdupLyPnx/vuAMDNhETYtMpU5pL8QmPlrzLhW8NqOBrjqkD+QSA6NW84eMwaagArdqohe+emPtKJJiDymOBVKzCX/qRmpR/Ux4GQjk858keoiDAbMrf19w03+UELSpopMHB3u086XMa6nG13w5vSWpwScOfkpHiW5TITRmI8n2sSdBx6BFJEt+24a/beI6NX3qKkdPxcpFny1+FWxeXF6JjmB9XS/QscrJ/jKqARONe0+WjDQBFAQsKUBpvRaCWjU/qJzHLj9RAWLAoQ9nA0uoaCjkdTbsMk4/5fGnQtnA33Hvjxlo3vN5Rg==
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM5PR04MB3137.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(346002)(396003)(39860400002)(376002)(366004)(136003)(5660300002)(478600001)(86362001)(16526019)(186003)(8936002)(83380400001)(6512007)(6666004)(26005)(2906002)(6486002)(316002)(4326008)(66946007)(8676002)(52116002)(956004)(6506007)(1076003)(66476007)(2616005)(7416002)(66556008);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData: ko5nrKEAGozwfIk9CVQZhjrij3ePTotHtY58BnQxiJTXUvcVXX1qU+qMhbX3KdP2sFtDOlxaoz9RiuMMmbgqwb2Qn1C4Dlk18NPLZ+B5oE2Qw2PFlJbF530cGVzO4+wCd+t4OmzQ8Ih2rt8TAtwrLii6UVkt3u8F4C1s1LuYHet/UFVwXvQ6gyp5I55C0cd6oy+PGdlNMP2Cl3CYVc9S/t2iLnCeLFy9wu31ZZnL6wDAkD4zvN0TVI3nWfGZP0BJnuvpO8fF6ccRlpOzFaOrBUKXdJb4QNab5qsVHqb/0pTJlxa7hi6453APjGZ9WaA0RbctfvJE9W9CqoJUZxmDIRQ55mc5n+3Xgj7pFYajZJuduBm6/WkZ4aYLn9hkf0XZ7mLp6NoRojWvX4vhYyBqLxfkEc1a6ActEeChn9oI9JXyCpc/t3sd9jbkKIZvjikChXtB9+f6jt3xw1w/tRdwRW8uBskwbLgGlo/aR2MIKRKKrZZmDB87gHL85btnVZ25os0m0aibuXHMUJMlzYcQiEJ+0Da3utxKPtLG0dx7ikjX+k8ZTJDqcsBEfXwgiomM6npD8LtXU+Qym8iWQFTEFYzyV45bM0Gsoxw4oeKg0wQk8RHgmrAA4Zebq4nVgipEVwTXLmULcZR592ubrI1AgQ==
X-OriginatorOrg: oss.nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b8a7d44d-3589-449f-f9c6-08d87edcce6e
X-MS-Exchange-CrossTenant-AuthSource: AM5PR04MB3137.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2020 03:10:09.5978
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: i3lxP5CRDWtBCX2Ya1g8durDtGZvC1gZKNTdvKeyFIu6Wfr34j04LTzVUgZ7E6U1ngwJbY4l2UyuTDw/YCfgmw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR04MB5173
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Mirela Rabulea <mirela.rabulea@nxp.com>

In the case we get an invalid stream, such as from v4l2-compliance
streaming test, jpeg_next_marker will end up parsing the entire
stream. The standard describes the high level syntax of a jpeg
as starting with SOI, ending with EOI, so return error if the very
first 2 bytes are not SOI.

Signed-off-by: Mirela Rabulea <mirela.rabulea@nxp.com>
---
 drivers/media/v4l2-core/v4l2-jpeg.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c
index a8198f98c158..244feccc4ea0 100644
--- a/drivers/media/v4l2-core/v4l2-jpeg.c
+++ b/drivers/media/v4l2-core/v4l2-jpeg.c
@@ -497,11 +497,8 @@ int v4l2_jpeg_parse_header(void *buf, size_t len, struct v4l2_jpeg_header *out)
 	out->num_dht = 0;
 	out->num_dqt = 0;
 
-	/* the first marker must be SOI */
-	marker = jpeg_next_marker(&stream);
-	if (marker < 0)
-		return marker;
-	if (marker != SOI)
+	/* the first bytes must be SOI, B.2.1 High-level syntax */
+	if (jpeg_get_word_be(&stream) != SOI)
 		return -EINVAL;
 
 	/* init value to signal if this marker is not present */
-- 
2.17.1