Path: csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod From: Sylwester Nawrocki Newsgroups: linux.kernel Subject: Re: [PATCH] [media] s3c-camif: fix out-of-bounds array access Date: Wed, 13 Sep 2017 18:00:01 +0200 Message-ID: References: X-Original-To: Arnd Bergmann X-Auditid: b6c32a47-f79db6d000003732-84-59b954c91db0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8"; format="flowed" Content-Language: en-GB Content-Transfer-Encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprIKsWRmVeSWpSXmKPExsWy7bCmue7JkJ2RBleOmlr8nXSM3eLyrjls Fj0btrJazDi/j8li2aY/TBbtT18yO7B5/P41idFj06pONo/Pm+QCmKO4bFJSczLLUov07RK4 Mnp64gsOcFW8XP6HtYHxNHsXIyeHhICJxJvbS9kgbDGJC/fWg9lCAjsYJRqXKXUxcgHZ3xkl rq/7Dtew7c8JVojEbkaJ5dO2M0I49xkl7s1/zgJSJSzgJvF/8nWwDhEBRYmpL54xgxQxC6xj kni/6itYgk3AUKL3aB8jiM0rYCfx5V0v2G4WAVWJQxvWg8VFBSIktn2fwQZRIyjxY/I9sAWc AsESDbeOgMWZBawknv1rZYWwxSWO3b/JCGHLS2xe8xZssYTAFjaJ39/+QT3qIjHr20YWCFtY 4tXxLVC/SUs8W7WREaKhn1HixJpmKGcGo8Sd9glMEFXWEoePX4RaxyfRcfgvUDcHUJxXoqNN CKLEQ+LPosusEGFHicZfApAgamGS6O48yjiBUX4WkodmIXliFpInZiF5YgEjyypGsdSC4tz0 1GKjAmO94sTc4tK8dL3k/NxNjOCEouW+g3HbOZ9DjAIcjEo8vA8sd0YKsSaWFVfmHmKU4GBW EuG19gEK8aYkVlalFuXHF5XmpBYfYpTmYFES563bdi1CSCA9sSQ1OzW1ILUIJsvEwSnVwGi7 oTKd4/qv9cUKC0+v+Xzvz8GdmhH37epyJosqHH7c5+FT8eiXj9pmrdg1cXN/vOrquJo4Ifpv y4m1GbZBrfPZi2eY3e7/KlrJH/X7bei9e47L5iQvCJk6Y7GOafdG0yfVzYlhF0v0PtdM7/if a3Rjx+ajnMWG9Qp327JrIk+WXrHKzvY+HKnEUpyRaKjFXFScCAAd+5auJAMAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrLLMWRmVeSWpSXmKPExsVy+t9jAd2TITsjDf6elbT4O+kYu8XlXXPY LHo2bGW1mHF+H5PFsk1/mCzan75kdmDz+P1rEqPHplWdbB6fN8kFMEdx2aSk5mSWpRbp2yVw ZfT0xBcc4Kp4ufwPawPjafYuRk4OCQETiW1/TrCC2EICOxklXl736WLkArIfMkr82vIALCEs 4Cbxf/J1sAYRAUWJqS+eMYMUMQtsYJJY+Oc+E0RHG5NE58UGZpAqNgFDid6jfYwgNq+AncSX d71sIDaLgKrEoQ3rweKiAhESfW8vs0PUCEr8mHyPBcTmFAiWeLLsH5jNLGAm8eXlYVYIW1zi 2P2bjBC2vMTmNW+ZJzAKzELSPgtJyywkLbOQtCxgZFnFKJlaUJybnltsVGCUl1quV5yYW1ya l66XnJ+7iREY6NsOa/XvYHy8JP4QowAHoxIP7wPLnZFCrIllxZW5hxglOJiVRHitfYBCvCmJ lVWpRfnxRaU5qcWHGKU5WJTEeTP7ZkQKCaQnlqRmp6YWpBbBZJk4OKUaGDeW2Qk+OCv8nnXa uq7/1i0Ldt34y3K3Urqw7oJX07cajVsmrdszU1Iu/JJQVffeoKU1+9KEykQ5of/GT202hD+N /dsYeiCxmcWTm2nf7oeWZwQ/c8fM/iOrI7Pz6+8dWTr7Ak75r6vosz4VE5r0siXjG2vjd9XV ySmvXRt2nXk+s331s0VftZVYijMSDbWYi4oTAVIvrV5wAgAA X-Cms-Mailid: 20170913155449epcas2p457adfa0c2ba9140a9c27d9bf3b84896e X-Msg-Generator: CA X-Sender-IP: 182.195.42.143 X-Local-Sender: =?UTF-8?B?U3lsd2VzdGVyIE5hd3JvY2tpG1NSUE9MLUtlcm5lbCAoVFAp?= =?UTF-8?B?G+yCvOyEseyghOyekBtTZW5pb3IgU29mdHdhcmUgRW5naW5lZXI=?= X-Global-Sender: =?UTF-8?B?U3lsd2VzdGVyIE5hd3JvY2tpG1NSUE9MLUtlcm5lbCAoVFAp?= =?UTF-8?B?G1NhbXN1bmcgRWxlY3Ryb25pY3MbU2VuaW9yIFNvZnR3YXJlIEVuZ2luZWVy?= X-Sender-Code: =?UTF-8?B?QzEwG0VIURtDMTBDRDAyQ0QwMjczOTI=?= Cms-Type: 102P X-Cms-Rootmailid: 20170913092551epcas1p4f84e118f364f605cb5cc6b8b669ac095 X-Rootmtr: 20170913092551epcas1p4f84e118f364f605cb5cc6b8b669ac095 Sender: robomod@news.nic.it List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Approved: robomod@news.nic.it Lines: 44 Organization: linux.* mail to news gateway X-Original-Cc: Sylwester Nawrocki , Mauro Carvalho Chehab , Linux Media Mailing List , "moderated list:ARM/SAMSUNG EXYNOS ARM ARCHITECTURES" , Linux Kernel Mailing List X-Original-Date: Wed, 13 Sep 2017 17:54:45 +0200 X-Original-Message-ID: X-Original-References: <20170912200932.3634089-1-arnd@arndb.de> <4355b20a-504c-4e83-92c8-049e6c6d6a5f@samsung.com> X-Original-Sender: linux-kernel-owner@vger.kernel.org Xref: csiph.com linux.kernel:1731692 On 09/13/2017 04:03 PM, Arnd Bergmann wrote: > On Wed, Sep 13, 2017 at 11:25 AM, Sylwester Nawrocki > wrote: >> On 09/12/2017 10:09 PM, Arnd Bergmann wrote: >>> { >>> const struct s3c_camif_variant *variant = camif->variant; >>> const struct vp_pix_limits *pix_lim; >>> - int i = ARRAY_SIZE(camif_mbus_formats); >>> >>> /* FIXME: constraints against codec or preview path ? */ >>> pix_lim = &variant->vp_pix_limits[VP_CODEC]; >>> >>> - while (i-- >= 0) >>> - if (camif_mbus_formats[i] == mf->code) >>> - break; >>> - >>> - mf->code = camif_mbus_formats[i]; >> >> Interesting finding... the function needs to ensure mf->code is set >> to one of supported values by the driver, so instead of removing >> how about changing the above line to: >> >> if (i < 0) >> mf->code = camif_mbus_formats[0]; >> >> ? > That would still have one of the two out-of-bounds accesses;-) Ah, indeed :/ > maybe this > > for (i = 0; i < ARRAY_SIZE(camif_mbus_formats); i++) > if (camif_mbus_formats[i] == mf->code) > break; > > if (i == ARRAY_SIZE(camif_mbus_formats)) > mf->code = camif_mbus_formats[0]; Yes, it should work that way. -- Thanks, Sylwester