Commit ca77fa5d authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab Committed by Zhao Yipeng
Browse files

media: v4l2-tpg: prevent the risk of a division by zero 

stable inclusion
from stable-v4.19.324
commit e3c36d0bde309f690ed1f9cd5f7e63b3a513f94a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5ATB
CVE: CVE-2024-50287

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.19.y&id=e3c36d0bde309f690ed1f9cd5f7e63b3a513f94a



--------------------------------

media: v4l2-tpg: prevent the risk of a division by zero

commit e6a3ea83fbe15d4818d01804e904cbb0e64e543b upstream.

As reported by Coverity, the logic at tpg_precalculate_line()
blindly rescales the buffer even when scaled_witdh is equal to
zero. If this ever happens, this will cause a division by zero.

Instead, add a WARN_ON_ONCE() to trigger such cases and return
without doing any precalculation.

Fixes: 63881df9 ("[media] vivid: add the Test Pattern Generator")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhao Yipeng <zhaoyipeng5@huawei.com>
parent 98beb6bc

drivers/media/common/v4l2-tpg/v4l2-tpg-core.c

+3 −0
Original line number Diff line number Diff line
@@ -1639,6 +1639,9 @@ static void tpg_precalculate_line(struct tpg_data *tpg) 
	unsigned p;

	unsigned x;



	if (WARN_ON_ONCE(!tpg->src_width || !tpg->scaled_width))

		return;



	switch (tpg->pattern) {

	case TPG_PAT_GREEN:

		contrast = TPG_COLOR_100_RED;