On Thu May 7 20:58:11 2026 +0000, Ricardo Ribalda wrote:
> Avoid invalid memory access if the zones_num is bigger than
> zone_weight.
>
> This patch fixes the following smatch errors:
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111
> c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111
> c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227
> c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227
> c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
>
> Cc: [email protected]
> Fixes: fb2e135208f3 ("media: platform: Add C3 ISP driver")
> Reviewed-by: Jacopo Mondi <[email protected]>
> Reviewed-by: Laurent Pinchart <[email protected]>
> Signed-off-by: Ricardo Ribalda <[email protected]>
> Reviewed-by: Keke Li <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 4 ++++
1 file changed, 4 insertions(+)
---
diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
index 6f9ca7a7dd88..aec3eed0e443 100644
--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
+++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
@@ -104,6 +104,8 @@ static void c3_isp_params_awb_wt(struct c3_isp_device *isp,
c3_isp_write(isp, ISP_AWB_BLK_WT_ADDR, 0);
zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
+ if (zones_num > C3_ISP_AWB_MAX_ZONES)
+ zones_num = C3_ISP_AWB_MAX_ZONES;
/* Need to write 8 weights at once */
for (i = 0; i < zones_num / 8; i++) {
@@ -220,6 +222,8 @@ static void c3_isp_params_ae_wt(struct c3_isp_device *isp,
c3_isp_write(isp, ISP_AE_BLK_WT_ADDR, 0);
zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
+ if (zones_num > C3_ISP_AE_MAX_ZONES)
+ zones_num = C3_ISP_AE_MAX_ZONES;
/* Need to write 8 weights at once */
for (i = 0; i < zones_num / 8; i++) {
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
