Re: [PATCH] v4l: soc_camera: fix bound checking of mbus_fmt[] index

2010-02-20 Thread Baruch Siach 
Hi Guennadi,

On Fri, Feb 19, 2010 at 06:26:06PM +0100, Guennadi Liakhovetski wrote:
 On Thu, 18 Feb 2010, Baruch Siach wrote:
 
 Thanks for the patch, but I decided to improve it a bit. In fact, the only 
 case my original version was missing was code == V4L2_MBUS_FMT_FIXED, the 
 correct test would be
 
 (unsigned int)(code - V4L2_MBUS_FMT_FIXED -1) = ARRAY_SIZE(mbus_fmt)
 
 but to make it simple we can indeed break this into two tests, the 
 compiler will optimise it for us. So, if you agree, I'll push the version 
 of your patch, attached at the bottom of this mail, for 2.6.33, so, please 
 reply asap...

That's OK by me.

baruch

  When code = V4L2_MBUS_FMT_FIXED soc_mbus_get_fmtdesc returns a pointer to
  mbus_fmt[x], where x  0. Fix this.
  
  Signed-off-by: Baruch Siach bar...@tkos.co.il
  ---
   drivers/media/video/soc_mediabus.c |2 ++
   1 files changed, 2 insertions(+), 0 deletions(-)
  
  diff --git a/drivers/media/video/soc_mediabus.c 
  b/drivers/media/video/soc_mediabus.c
  index f8d5c87..a2808e2 100644
  --- a/drivers/media/video/soc_mediabus.c
  +++ b/drivers/media/video/soc_mediabus.c
  @@ -136,6 +136,8 @@ const struct soc_mbus_pixelfmt *soc_mbus_get_fmtdesc(
   {
  if ((unsigned int)(code - V4L2_MBUS_FMT_FIXED)  ARRAY_SIZE(mbus_fmt))
  return NULL;
  +   if ((unsigned int)code = V4L2_MBUS_FMT_FIXED)
  +   return NULL;
  return mbus_fmt + code - V4L2_MBUS_FMT_FIXED - 1;
   }
   EXPORT_SYMBOL(soc_mbus_get_fmtdesc);
  -- 
  1.6.6.1
  
 
 ---
 Guennadi Liakhovetski, Ph.D.
 Freelance Open-Source Software Developer
 http://www.open-technology.de/
 
 
 From 00109d655b4b8cf25bc68a215966be810e372e87 Mon Sep 17 00:00:00 2001
 From: Baruch Siach bar...@tkos.co.il
 Date: Fri, 19 Feb 2010 18:09:25 +0100
 Subject: [PATCH] v4l: soc_camera: fix bound checking of mbus_fmt[] index
 
 When code = V4L2_MBUS_FMT_FIXED soc_mbus_get_fmtdesc returns a pointer to
 mbus_fmt[x], where x  0. Fix this.
 
 Signed-off-by: Baruch Siach bar...@tkos.co.il
 Signed-off-by: Guennadi Liakhovetski g.liakhovet...@gmx.de
 ---
  drivers/media/video/soc_mediabus.c |3 ++-
  1 files changed, 2 insertions(+), 1 deletions(-)
 
 diff --git a/drivers/media/video/soc_mediabus.c 
 b/drivers/media/video/soc_mediabus.c
 index f8d5c87..a4c0ef4 100644
 --- a/drivers/media/video/soc_mediabus.c
 +++ b/drivers/media/video/soc_mediabus.c
 @@ -134,7 +134,8 @@ EXPORT_SYMBOL(soc_mbus_bytes_per_line);
  const struct soc_mbus_pixelfmt *soc_mbus_get_fmtdesc(
   enum v4l2_mbus_pixelcode code)
  {
 - if ((unsigned int)(code - V4L2_MBUS_FMT_FIXED)  ARRAY_SIZE(mbus_fmt))
 + if (code - V4L2_MBUS_FMT_FIXED  ARRAY_SIZE(mbus_fmt) ||
 + code = V4L2_MBUS_FMT_FIXED)
   return NULL;
   return mbus_fmt + code - V4L2_MBUS_FMT_FIXED - 1;
  }
 -- 
 1.6.2.4
 

-- 
 ~. .~   Tk Open Systems
=}ooO--U--Ooo{=
   - bar...@tkos.co.il - tel: +972.2.679.5364, http://www.tkos.co.il -
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] v4l: soc_camera: fix bound checking of mbus_fmt[] index

2010-02-19 Thread Guennadi Liakhovetski 
On Thu, 18 Feb 2010, Baruch Siach wrote:

Thanks for the patch, but I decided to improve it a bit. In fact, the only 
case my original version was missing was code == V4L2_MBUS_FMT_FIXED, the 
correct test would be

(unsigned int)(code - V4L2_MBUS_FMT_FIXED -1) = ARRAY_SIZE(mbus_fmt)

but to make it simple we can indeed break this into two tests, the 
compiler will optimise it for us. So, if you agree, I'll push the version 
of your patch, attached at the bottom of this mail, for 2.6.33, so, please 
reply asap...

Thanks
Guennadi

 When code = V4L2_MBUS_FMT_FIXED soc_mbus_get_fmtdesc returns a pointer to
 mbus_fmt[x], where x  0. Fix this.
 
 Signed-off-by: Baruch Siach bar...@tkos.co.il
 ---
  drivers/media/video/soc_mediabus.c |2 ++
  1 files changed, 2 insertions(+), 0 deletions(-)
 
 diff --git a/drivers/media/video/soc_mediabus.c 
 b/drivers/media/video/soc_mediabus.c
 index f8d5c87..a2808e2 100644
 --- a/drivers/media/video/soc_mediabus.c
 +++ b/drivers/media/video/soc_mediabus.c
 @@ -136,6 +136,8 @@ const struct soc_mbus_pixelfmt *soc_mbus_get_fmtdesc(
  {
   if ((unsigned int)(code - V4L2_MBUS_FMT_FIXED)  ARRAY_SIZE(mbus_fmt))
   return NULL;
 + if ((unsigned int)code = V4L2_MBUS_FMT_FIXED)
 + return NULL;
   return mbus_fmt + code - V4L2_MBUS_FMT_FIXED - 1;
  }
  EXPORT_SYMBOL(soc_mbus_get_fmtdesc);
 -- 
 1.6.6.1
 

---
Guennadi Liakhovetski, Ph.D.
Freelance Open-Source Software Developer
http://www.open-technology.de/


From 00109d655b4b8cf25bc68a215966be810e372e87 Mon Sep 17 00:00:00 2001
From: Baruch Siach bar...@tkos.co.il
Date: Fri, 19 Feb 2010 18:09:25 +0100
Subject: [PATCH] v4l: soc_camera: fix bound checking of mbus_fmt[] index

When code = V4L2_MBUS_FMT_FIXED soc_mbus_get_fmtdesc returns a pointer to
mbus_fmt[x], where x  0. Fix this.

Signed-off-by: Baruch Siach bar...@tkos.co.il
Signed-off-by: Guennadi Liakhovetski g.liakhovet...@gmx.de
---
 drivers/media/video/soc_mediabus.c |3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/media/video/soc_mediabus.c 
b/drivers/media/video/soc_mediabus.c
index f8d5c87..a4c0ef4 100644
--- a/drivers/media/video/soc_mediabus.c
+++ b/drivers/media/video/soc_mediabus.c
@@ -134,7 +134,8 @@ EXPORT_SYMBOL(soc_mbus_bytes_per_line);
 const struct soc_mbus_pixelfmt *soc_mbus_get_fmtdesc(
enum v4l2_mbus_pixelcode code)
 {
-   if ((unsigned int)(code - V4L2_MBUS_FMT_FIXED)  ARRAY_SIZE(mbus_fmt))
+   if (code - V4L2_MBUS_FMT_FIXED  ARRAY_SIZE(mbus_fmt) ||
+   code = V4L2_MBUS_FMT_FIXED)
return NULL;
return mbus_fmt + code - V4L2_MBUS_FMT_FIXED - 1;
 }
-- 
1.6.2.4

--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] v4l: soc_camera: fix bound checking of mbus_fmt[] index

2010-02-17 Thread Baruch Siach 
When code = V4L2_MBUS_FMT_FIXED soc_mbus_get_fmtdesc returns a pointer to
mbus_fmt[x], where x  0. Fix this.

Signed-off-by: Baruch Siach bar...@tkos.co.il
---
 drivers/media/video/soc_mediabus.c |2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/media/video/soc_mediabus.c 
b/drivers/media/video/soc_mediabus.c
index f8d5c87..a2808e2 100644
--- a/drivers/media/video/soc_mediabus.c
+++ b/drivers/media/video/soc_mediabus.c
@@ -136,6 +136,8 @@ const struct soc_mbus_pixelfmt *soc_mbus_get_fmtdesc(
 {
if ((unsigned int)(code - V4L2_MBUS_FMT_FIXED)  ARRAY_SIZE(mbus_fmt))
return NULL;
+   if ((unsigned int)code = V4L2_MBUS_FMT_FIXED)
+   return NULL;
return mbus_fmt + code - V4L2_MBUS_FMT_FIXED - 1;
 }
 EXPORT_SYMBOL(soc_mbus_get_fmtdesc);
-- 
1.6.6.1

--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html