This is an automatic generated email to let you know that the following patch were queued at the http://git.linuxtv.org/v4l-utils.git tree:
Subject: libv4lconvert: Reject too short source buffer before accessing it Author: Gregor Jasny <gja...@googlemail.com> Date: Thu Aug 15 22:40:39 2013 +0200 Signed-off-by: Gregor Jasny <gja...@googlemail.com> lib/libv4lconvert/libv4lconvert.c | 129 +++++++++++++++++++------------------ 1 files changed, 67 insertions(+), 62 deletions(-) --- http://git.linuxtv.org/v4l-utils.git?a=commitdiff;h=efc29f1764a30808ebf7b3e1d9bfa27b909bf641 diff --git a/lib/libv4lconvert/libv4lconvert.c b/lib/libv4lconvert/libv4lconvert.c index 2aec99a..e2afc27 100644 --- a/lib/libv4lconvert/libv4lconvert.c +++ b/lib/libv4lconvert/libv4lconvert.c @@ -934,6 +934,11 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, case V4L2_PIX_FMT_SGBRG8: case V4L2_PIX_FMT_SGRBG8: case V4L2_PIX_FMT_SRGGB8: + if (src_size < (width * height)) { + V4LCONVERT_ERR("short raw bayer data frame\n"); + errno = EPIPE; + result = -1; + } switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: v4lconvert_bayer_to_rgb24(src, dest, width, height, bytesperline, src_pix_fmt); @@ -948,11 +953,6 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_bayer_to_yuv420(src, dest, width, height, bytesperline, src_pix_fmt, 1); break; } - if (src_size < (width * height)) { - V4LCONVERT_ERR("short raw bayer data frame\n"); - errno = EPIPE; - result = -1; - } break; case V4L2_PIX_FMT_SE401: { @@ -993,6 +993,11 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, } case V4L2_PIX_FMT_Y16: + if (src_size < (width * height * 2)) { + V4LCONVERT_ERR("short y16 data frame\n"); + errno = EPIPE; + result = -1; + } switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: case V4L2_PIX_FMT_BGR24: @@ -1003,16 +1008,16 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_y16_to_yuv420(src, dest, fmt); break; } - if (src_size < (width * height * 2)) { - V4LCONVERT_ERR("short y16 data frame\n"); - errno = EPIPE; - result = -1; - } break; case V4L2_PIX_FMT_GREY: case V4L2_PIX_FMT_Y4: case V4L2_PIX_FMT_Y6: + if (src_size < (width * height)) { + V4LCONVERT_ERR("short grey data frame\n"); + errno = EPIPE; + result = -1; + } switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: case V4L2_PIX_FMT_BGR24: @@ -1023,14 +1028,14 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_grey_to_yuv420(src, dest, fmt); break; } - if (src_size < (width * height)) { - V4LCONVERT_ERR("short grey data frame\n"); - errno = EPIPE; - result = -1; - } break; case V4L2_PIX_FMT_Y10BPACK: + if (src_size < (width * height * 10 / 8)) { + V4LCONVERT_ERR("short y10b data frame\n"); + errno = EPIPE; + result = -1; + } switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: case V4L2_PIX_FMT_BGR24: @@ -1043,14 +1048,19 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, width, height); break; } - if (result == 0 && src_size < (width * height * 10 / 8)) { - V4LCONVERT_ERR("short y10b data frame\n"); + if (result == 0) { + V4LCONVERT_ERR("y10b conversion failed\n"); errno = EPIPE; result = -1; } break; case V4L2_PIX_FMT_RGB565: + if (src_size < (width * height * 2)) { + V4LCONVERT_ERR("short rgb565 data frame\n"); + errno = EPIPE; + result = -1; + } switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: v4lconvert_rgb565_to_rgb24(src, dest, width, height); @@ -1065,14 +1075,14 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_rgb565_to_yuv420(src, dest, fmt, 1); break; } - if (src_size < (width * height * 2)) { - V4LCONVERT_ERR("short rgb565 data frame\n"); - errno = EPIPE; - result = -1; - } break; case V4L2_PIX_FMT_RGB24: + if (src_size < (width * height * 3)) { + V4LCONVERT_ERR("short rgb24 data frame\n"); + errno = EPIPE; + result = -1; + } switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: memcpy(dest, src, width * height * 3); @@ -1087,14 +1097,14 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_rgb24_to_yuv420(src, dest, fmt, 0, 1, 3); break; } + break; + + case V4L2_PIX_FMT_BGR24: if (src_size < (width * height * 3)) { - V4LCONVERT_ERR("short rgb24 data frame\n"); + V4LCONVERT_ERR("short bgr24 data frame\n"); errno = EPIPE; result = -1; } - break; - - case V4L2_PIX_FMT_BGR24: switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: v4lconvert_swap_rgb(src, dest, width, height); @@ -1109,14 +1119,14 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_rgb24_to_yuv420(src, dest, fmt, 1, 1, 3); break; } - if (src_size < (width * height * 3)) { - V4LCONVERT_ERR("short bgr24 data frame\n"); - errno = EPIPE; - result = -1; - } break; case V4L2_PIX_FMT_RGB32: + if (src_size < (width * height * 4)) { + V4LCONVERT_ERR("short rgb32 data frame\n"); + errno = EPIPE; + result = -1; + } switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: v4lconvert_rgb32_to_rgb24(src, dest, width, height, 0); @@ -1131,14 +1141,14 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_rgb24_to_yuv420(src, dest, fmt, 0, 1, 4); break; } + break; + + case V4L2_PIX_FMT_BGR32: if (src_size < (width * height * 4)) { - V4LCONVERT_ERR("short rgb32 data frame\n"); + V4LCONVERT_ERR("short bgr32 data frame\n"); errno = EPIPE; result = -1; } - break; - - case V4L2_PIX_FMT_BGR32: switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: v4lconvert_rgb32_to_rgb24(src, dest, width, height, 1); @@ -1153,14 +1163,14 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_rgb24_to_yuv420(src, dest, fmt, 1, 1, 4); break; } - if (src_size < (width * height * 4)) { - V4LCONVERT_ERR("short bgr32 data frame\n"); - errno = EPIPE; - result = -1; - } break; case V4L2_PIX_FMT_YUV420: + if (src_size < (width * height * 3 / 2)) { + V4LCONVERT_ERR("short yuv420 data frame\n"); + errno = EPIPE; + result = -1; + } switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: v4lconvert_yuv420_to_rgb24(src, dest, width, @@ -1177,14 +1187,14 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_swap_uv(src, dest, fmt); break; } + break; + + case V4L2_PIX_FMT_YVU420: if (src_size < (width * height * 3 / 2)) { - V4LCONVERT_ERR("short yuv420 data frame\n"); + V4LCONVERT_ERR("short yvu420 data frame\n"); errno = EPIPE; result = -1; } - break; - - case V4L2_PIX_FMT_YVU420: switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: v4lconvert_yuv420_to_rgb24(src, dest, width, @@ -1201,14 +1211,14 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, memcpy(dest, src, width * height * 3 / 2); break; } - if (src_size < (width * height * 3 / 2)) { - V4LCONVERT_ERR("short yvu420 data frame\n"); - errno = EPIPE; - result = -1; - } break; case V4L2_PIX_FMT_YUYV: + if (src_size < (width * height * 2)) { + V4LCONVERT_ERR("short yuyv data frame\n"); + errno = EPIPE; + result = -1; + } switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: v4lconvert_yuyv_to_rgb24(src, dest, width, height, bytesperline); @@ -1223,14 +1233,14 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_yuyv_to_yuv420(src, dest, width, height, bytesperline, 1); break; } + break; + + case V4L2_PIX_FMT_YVYU: if (src_size < (width * height * 2)) { - V4LCONVERT_ERR("short yuyv data frame\n"); + V4LCONVERT_ERR("short yvyu data frame\n"); errno = EPIPE; result = -1; } - break; - - case V4L2_PIX_FMT_YVYU: switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: v4lconvert_yvyu_to_rgb24(src, dest, width, height, bytesperline); @@ -1247,14 +1257,14 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_yuyv_to_yuv420(src, dest, width, height, bytesperline, 0); break; } + break; + + case V4L2_PIX_FMT_UYVY: if (src_size < (width * height * 2)) { - V4LCONVERT_ERR("short yvyu data frame\n"); + V4LCONVERT_ERR("short uyvy data frame\n"); errno = EPIPE; result = -1; } - break; - - case V4L2_PIX_FMT_UYVY: switch (dest_pix_fmt) { case V4L2_PIX_FMT_RGB24: v4lconvert_uyvy_to_rgb24(src, dest, width, height, bytesperline); @@ -1269,11 +1279,6 @@ static int v4lconvert_convert_pixfmt(struct v4lconvert_data *data, v4lconvert_uyvy_to_yuv420(src, dest, width, height, bytesperline, 1); break; } - if (src_size < (width * height * 2)) { - V4LCONVERT_ERR("short uyvy data frame\n"); - errno = EPIPE; - result = -1; - } break; default: _______________________________________________ linuxtv-commits mailing list linuxtv-commits@linuxtv.org http://www.linuxtv.org/cgi-bin/mailman/listinfo/linuxtv-commits
