Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-07 12:41:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

[media] v4l2-ctrls: fix corner case in round-to-range code

Browse Source 
If you have a maximum that is at the limit of what the type supports,
and the step is > 1, then you can get wrap-around errors since the
code assumes that the maximum that the type supports is
ctrl->maximum + ctrl->step / 2.

In practice this is always fine, but in artificially crafted ranges
you will hit this bug. Since this is core code it should just work.

This bug has always been there but since it doesn't cause problems in
practice it was never noticed.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
This commit is contained in:
Hans Verkuil 2014-07-18 05:15:21 -03:00 committed by Mauro Carvalho Chehab
parent 12c78e665f
commit 958c7c7e65
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/media/v4l2-core/v4l2-ctrls.c
View File

@ -1295,11 +1295,19 @@ static void std_log(const struct v4l2_ctrl *ctrl)
}
}
/* Round towards the closest legal value */
/*
* Round towards the closest legal value. Be careful when we are
* close to the maximum range of the control type to prevent
* wrap-arounds.
*/
#define ROUND_TO_RANGE(val, offset_type, ctrl) \
({ \
offset_type offset; \
val += (ctrl)->step / 2; \
if ((ctrl)->maximum >= 0 && \
val >= (ctrl)->maximum - ((ctrl)->step / 2)) \
val = (ctrl)->maximum; \
else \
val += (ctrl)->step / 2; \
val = clamp_t(typeof(val), val, \
(ctrl)->minimum, (ctrl)->maximum); \
offset = (val) - (ctrl)->minimum; \
@ -1325,7 +1333,10 @@ static int std_validate(const struct v4l2_ctrl *ctrl, u32 idx,
* the u64 divide that needs special care.
*/
val = ptr.p_s64[idx];
val += ctrl->step / 2;
if (ctrl->maximum >= 0 && val >= ctrl->maximum - ctrl->step / 2)
val = ctrl->maximum;
else
val += ctrl->step / 2;
val = clamp_t(s64, val, ctrl->minimum, ctrl->maximum);
offset = val - ctrl->minimum;
do_div(offset, ctrl->step);