On Wed Jul 1 23:06:10 2026 +0800, Runyu Xiao wrote:
> delta_mjpeg_read_header() scans a compressed MJPEG access unit byte by
> byte and passes the bytes after an SOF marker to delta_mjpeg_read_sof().
> The SOF parser then reads 16-bit big-endian fields directly from that
> byte stream.
>
> The SOF payload is not an aligned object. The marker scan can find the
> payload at any byte position, and the SOF layout also puts frame_height
> and frame_width after a one-byte sample_precision field. Those fields
> therefore sit at odd offsets within the payload even when the payload
> base happens to be 2-byte aligned.
>
> Avoid casting the byte stream to __be16 pointers and use
> get_unaligned_be16() for the SOF length, height, and width fields.
>
> This issue was detected by our static analysis tool and confirmed by
> manual audit. A focused UBSAN alignment validation of the same typed
> load shape reported a misaligned __be16 access in delta_mjpeg_read_sof().
>
> Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
> Cc: [email protected]
> Signed-off-by: Runyu Xiao <[email protected]>
> Reviewed-by: Nicolas Dufresne <[email protected]>
> Signed-off-by: Nicolas Dufresne <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
---
diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
index 90e5b2f72c82..849a5e118aec 100644
--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
+++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-hdr.c
@@ -4,6 +4,7 @@
* Author: Hugues Fruchet <[email protected]> for STMicroelectronics.
*/
+#include <linux/unaligned.h>
#include "delta.h"
#include "delta-mjpeg.h"
@@ -48,13 +49,13 @@ static int delta_mjpeg_read_sof(struct delta_ctx *pctx,
goto err_no_more;
memset(header, 0, sizeof(*header));
- header->length = be16_to_cpu(*(__be16 *)(data + offset));
+ header->length = get_unaligned_be16(data + offset);
offset += sizeof(u16);
header->sample_precision = *(u8 *)(data + offset);
offset += sizeof(u8);
- header->frame_height = be16_to_cpu(*(__be16 *)(data + offset));
+ header->frame_height = get_unaligned_be16(data + offset);
offset += sizeof(u16);
- header->frame_width = be16_to_cpu(*(__be16 *)(data + offset));
+ header->frame_width = get_unaligned_be16(data + offset);
offset += sizeof(u16);
header->nb_of_components = *(u8 *)(data + offset);
offset += sizeof(u8);
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
