Unverified Commit ec820b43 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13426 media: s5p-jpeg: prevent buffer overflows 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Kunbo <zhangkunbo@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/WR6ANGHKL7WRPITB7KDRUBBPY2VUJ7QD/ 
 
https://gitee.com/src-openeuler/kernel/issues/IB5KQX 
 
Link:https://gitee.com/openeuler/kernel/pulls/13426

 

Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 48fd6060 ddf4b47d

drivers/media/platform/s5p-jpeg/jpeg-core.c

+11 −6
Original line number Diff line number Diff line
@@ -803,11 +803,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) 
		(unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2;

	jpeg_buffer.curr = 0;



	word = 0;



	if (get_word_be(&jpeg_buffer, &word))

		return;



	if (word < 2)

		jpeg_buffer.size = 0;

	else

		jpeg_buffer.size = (long)word - 2;



	jpeg_buffer.data += 2;

	jpeg_buffer.curr = 0;
@@ -1086,6 +1089,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, unsigned int *word) 
	if (byte == -1)

		return -1;

	*word = (unsigned int)byte | temp;



	return 0;

}
@@ -1173,7 +1177,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, 
			if (get_word_be(&jpeg_buffer, &word))

				break;

			length = (long)word - 2;

			if (!length)

			if (length <= 0)

				return false;

			sof = jpeg_buffer.curr; /* after 0xffc0 */

			sof_len = length;
@@ -1204,7 +1208,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, 
			if (get_word_be(&jpeg_buffer, &word))

				break;

			length = (long)word - 2;

			if (!length)

			if (length <= 0)

				return false;

			if (n_dqt >= S5P_JPEG_MAX_MARKER)

				return false;
@@ -1217,7 +1221,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, 
			if (get_word_be(&jpeg_buffer, &word))

				break;

			length = (long)word - 2;

			if (!length)

			if (length <= 0)

				return false;

			if (n_dht >= S5P_JPEG_MAX_MARKER)

				return false;
@@ -1242,6 +1246,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, 
			if (get_word_be(&jpeg_buffer, &word))

				break;

			length = (long)word - 2;

			/* No need to check underflows as skip() does it  */

			skip(&jpeg_buffer, length);

			break;

		}