From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1EDD0C46499 for ; Fri, 5 Jul 2019 14:52:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id F1D5821738 for ; Fri, 5 Jul 2019 14:52:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727627AbfGEOwV (ORCPT ); Fri, 5 Jul 2019 10:52:21 -0400 Received: from bhuna.collabora.co.uk ([46.235.227.227]:36322 "EHLO bhuna.collabora.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727574AbfGEOwV (ORCPT ); Fri, 5 Jul 2019 10:52:21 -0400 Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: ezequiel) with ESMTPSA id 3DF3728B494 From: Ezequiel Garcia To: linux-media@vger.kernel.org, Hans Verkuil Cc: kernel@collabora.com, Nicolas Dufresne , Tomasz Figa , linux-rockchip@lists.infradead.org, Heiko Stuebner , Jonas Karlman , Philipp Zabel , Boris Brezillon , Paul Kocialkowski , Alexandre Courbot , fbuergisser@chromium.org, linux-kernel@vger.kernel.org, Ezequiel Garcia Subject: [PATCH v3 3/4] media: v4l2-ctrl: Validate VP8 stateless decoder controls Date: Fri, 5 Jul 2019 11:50:49 -0300 Message-Id: <20190705145050.25911-4-ezequiel@collabora.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190705145050.25911-1-ezequiel@collabora.com> References: <20190705145050.25911-1-ezequiel@collabora.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Only one field needs to be validated: 'num_dct_parts'. This field is used to iterate over the user-provided array 'dct_part_sizes'. Signed-off-by: Ezequiel Garcia --- Changes from v2: * New patch --- drivers/media/v4l2-core/v4l2-ctrls.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c index b2c9f5816c4a..b51b89b841c1 100644 --- a/drivers/media/v4l2-core/v4l2-ctrls.c +++ b/drivers/media/v4l2-core/v4l2-ctrls.c @@ -1637,6 +1637,7 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx, union v4l2_ctrl_ptr ptr) { struct v4l2_ctrl_mpeg2_slice_params *p_mpeg2_slice_params; + struct v4l2_ctrl_vp8_frame_header *p_vp8_frame_header; void *p = ptr.p + idx * ctrl->elem_size; switch ((u32)ctrl->type) { @@ -1696,6 +1697,17 @@ static int std_validate_compound(const struct v4l2_ctrl *ctrl, u32 idx, break; case V4L2_CTRL_TYPE_VP8_FRAME_HEADER: + p_vp8_frame_header = p; + + switch (p_vp8_frame_header->num_dct_parts) { + case 1: + case 2: + case 4: + case 8: + break; + default: + return -EINVAL; + } break; default: return -EINVAL; -- 2.20.1