Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Ming Qian <ming.qian@nxp.com>
To:     mchehab@kernel.org, mirela.rabulea@oss.nxp.com,
        hverkuil-cisco@xs4all.nl
Cc:     shawnguo@kernel.org, s.hauer@pengutronix.de, kernel@pengutronix.de,
        festevam@gmail.com, xiahong.bao@nxp.com, linux-imx@nxp.com,
        linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
        devicetree@vger.kernel.org, linux-arm-kernel@lists.infradead.org
Subject: [PATCH] media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
Date:   Fri, 16 Dec 2022 16:30:33 +0800
Message-Id: <20221216083033.7446-1-ming.qian@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?8edhVkx5fuXiiTd3pgqJTo8SZExolszD/zNnpJ3AoFm+L3Qh8IY3LKBKGZGh?=
 =?us-ascii?Q?9IjmEG1t5xvjC8fDdEghn4hbzoBdAK+YGCdfPhY8NUs11HLc0zl23kl/oMnQ?=
 =?us-ascii?Q?eMHimVawu488O/oXJ/afzLbErKdoItr2ulS5tYKTDQR+h3YAIzIRd4hSuz9q?=
 =?us-ascii?Q?dAs6UYMWsyKiLs1cMy9OZb04jK+U6cOcrEADkTF5cPzkDnDoJRflU3rlAxx6?=
 =?us-ascii?Q?1JD3rttyOpXWPjlf/BgUqGuGz1YqbHWwFEzQ5OfCsuPq/w8svJ0gTrBBfx7/?=
 =?us-ascii?Q?ptPIWqqkr4cO+GEIlwsrNldQw5wq+Mzagilr6giHvXn8t7aNNsZmwn8fczLR?=
 =?us-ascii?Q?tKeNgpbprNiHqXDN8GBgsckSCOOM7qKbp4JFHwmiBi3Lex9DhbVCRcq3zWMf?=
 =?us-ascii?Q?X3i0qjEyax13cMeBFSL47c16LQ6Iiu9yNv1A9QfSQQErCWPU+bzSyJ6yrGlu?=
 =?us-ascii?Q?lt+SqlEfB4mikUE7YGtutYQlPNZuH5JJi/P/WcRbQSaRoHIPqGvj+ba4Mtwh?=
 =?us-ascii?Q?WMEbv2DRMPFaESFhRJAJ+lEMwXr6j3S8r8jRlPQLkBeRT4vQ3P5DeddjZgoZ?=
 =?us-ascii?Q?uDOgPFbG/PEG1jln2hxziMVPZaPP9rxdPMidQXdNMarcv79fm4xmmzja4QVC?=
 =?us-ascii?Q?0Ae+rb3Yc6Mgc7TAZEs5Eum0VLnNgQHF+P6m5o2I+hfFzTdbcGmjgepjZsap?=
 =?us-ascii?Q?bVdhb9haC8W+tRr8rJYnkJZX1u4nkiJiHiPAW2KB2eWBqNLNxprTrh7ZMo3h?=
 =?us-ascii?Q?+Bv0oFyjeEnzHnud0qMbNkzoN5LYVM8wfsCuDIQBLsGPYYCYHKKmjTZ7VciK?=
 =?us-ascii?Q?ey5ZuUZn2IwA+n6JrSlSowO0L+UsLU8lGv8gLBZd85mNtalIcrPLk6nKb9Vm?=
 =?us-ascii?Q?E3W3BtFgKqalennAqfbagUoob07uKsLqBRmix4Jii5t4dxHvwzCm6zn3nPgN?=
 =?us-ascii?Q?f6x6kR16BgdS7HAgWeRokqnEP2ncO+JlOxo1mk4E4styd3lhqMfC7GLu8xtF?=
 =?us-ascii?Q?/bTMEEy2Y1/B+uyuqT2+w/A3TapVt59ijRPgGWrQsLuG8LACmDgcYk97QvlL?=
 =?us-ascii?Q?YuhumZ83GfLfbgTQZxaUG2+8aWFA6sv/m3sEFcHhzYtH8UHyB8hldv+qex/p?=
 =?us-ascii?Q?3gMyFTVkz/z3dzH9GcA0qp6LPPc6+V/Nh2KCFaTcYV6maONPSw59ywnlxlSK?=
 =?us-ascii?Q?3D5AI8lXdPCI3d0kE4oxmsttSrpkCLmh2et6iIiDsQ6AwrzQaPzGBEgiM40K?=
 =?us-ascii?Q?lUKH3x24l2fTfCS50VhUCVtVizk/ROXdK7vuOKENYrhBPDiH18thXLx4N0mb?=
 =?us-ascii?Q?9Qu7ZQzvVKkqHdbC6ZDSQ9pdDdduQgfbRXD43C4hMI7d4pvNjrz4feZiFbzp?=
 =?us-ascii?Q?qrmKEtHaDPIcXs2jIlK7IxLYB6PZ4cNyz5iqWxq12yAin9WOR/sUCtDASs/D?=
 =?us-ascii?Q?01Q28puBNVcEILqqwyzKDP6YHqrHD4tb8xeIEDy3zNi9TQbfDvR9i9pLjxih?=
 =?us-ascii?Q?ie5zv9jqhhOhV9wt49z84LeautEIgJZC9C7utW4jXQndFCDgT7RBkNB4zSq7?=
 =?us-ascii?Q?Ass45ouc/A2JSpnUIxp3TRcapjG4FlQavASbcCBQ?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 43c7ff79-dd8b-450b-4d11-08dadf3fd652
X-MS-Exchange-CrossTenant-AuthSource: AM6PR04MB6341.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Dec 2022 08:30:50.1279
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: wMW4+2UDO1frr5OyNXsj0qi0NRGQBg4OfEowlXzRgCNrIBDrEnrMErFGp8FVNME5W+GKVWwyVONU50yAz8jVfQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXPR04MB9154
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The curr pointer has advanced 14 bytes in jpeg_parse_app14_data.
1. jpeg_get_word_be(stream), it goes forward 2 bytes.
2. jpeg_skip(stream, 11), it goes forward 11 bytes.
3. jpeg_get_byte(stream), it goes forward 1 bytes.

so the remain bytes of this segment should be (lp - 2 - 11 - 1),
but not (lp - 2 - 11).

if driver skip 1 extra bytes, the following parsing may go wrong.

Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
---
 drivers/media/v4l2-core/v4l2-jpeg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c
index c2513b775f6a..75c2af763d55 100644
--- a/drivers/media/v4l2-core/v4l2-jpeg.c
+++ b/drivers/media/v4l2-core/v4l2-jpeg.c
@@ -474,7 +474,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream,
 	*tf = ret;
 
 	/* skip the rest of the segment, this ensures at least it is complete */
-	skip = lp - 2 - 11;
+	skip = lp - 2 - 11 - 1;
 	return jpeg_skip(stream, skip);
 }
 
-- 
2.38.1