Unverified Commit cd00afe1 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13419 media: s5p-jpeg: prevent buffer overflows 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Kunbo <zhangkunbo@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/NTEGJVM4VE3XAOMHUO44U5YCPKP7HR2I/ 
 
https://gitee.com/src-openeuler/kernel/issues/IB5KQX 
 
Link:https://gitee.com/openeuler/kernel/pulls/13419

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents 7987d83a 94994898

drivers/media/platform/s5p-jpeg/jpeg-core.c

+11 −6
Original line number Diff line number Diff line
@@ -775,11 +775,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) 
		(unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2;

	jpeg_buffer.curr = 0;



	word = 0;



	if (get_word_be(&jpeg_buffer, &word))

		return;



	if (word < 2)

		jpeg_buffer.size = 0;

	else

		jpeg_buffer.size = (long)word - 2;



	jpeg_buffer.data += 2;

	jpeg_buffer.curr = 0;
@@ -1058,6 +1061,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, unsigned int *word) 
	if (byte == -1)

		return -1;

	*word = (unsigned int)byte | temp;



	return 0;

}
@@ -1145,7 +1149,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, 
			if (get_word_be(&jpeg_buffer, &word))

				break;

			length = (long)word - 2;

			if (!length)

			if (length <= 0)

				return false;

			sof = jpeg_buffer.curr; /* after 0xffc0 */

			sof_len = length;
@@ -1176,7 +1180,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, 
			if (get_word_be(&jpeg_buffer, &word))

				break;

			length = (long)word - 2;

			if (!length)

			if (length <= 0)

				return false;

			if (n_dqt >= S5P_JPEG_MAX_MARKER)

				return false;
@@ -1189,7 +1193,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, 
			if (get_word_be(&jpeg_buffer, &word))

				break;

			length = (long)word - 2;

			if (!length)

			if (length <= 0)

				return false;

			if (n_dht >= S5P_JPEG_MAX_MARKER)

				return false;
@@ -1214,6 +1218,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, 
			if (get_word_be(&jpeg_buffer, &word))

				break;

			length = (long)word - 2;

			/* No need to check underflows as skip() does it  */

			skip(&jpeg_buffer, length);

			break;

		}