Re: [PATCH] [media] s3c-camif: fix out-of-bounds array access

[Sylwester Nawrocki]

On 09/13/2017 04:03 PM, Arnd Bergmann wrote:
> On Wed, Sep 13, 2017 at 11:25 AM, Sylwester Nawrocki
> <s.nawrocki@xxxxxxxxxxx>  wrote:
> > On 09/12/2017 10:09 PM, Arnd Bergmann wrote:
> > >    {
> > >        const struct s3c_camif_variant *variant = camif->variant;
> > >        const struct vp_pix_limits *pix_lim;
> > > -     int i = ARRAY_SIZE(camif_mbus_formats);
> > >
> > >        /* FIXME: constraints against codec or preview path ? */
> > >        pix_lim = &variant->vp_pix_limits[VP_CODEC];
> > >
> > > -     while (i-- >= 0)
> > > -             if (camif_mbus_formats[i] == mf->code)
> > > -                     break;
> > > -
> > > -     mf->code = camif_mbus_formats[i];
> >
> > Interesting finding... the function needs to ensure mf->code is set
> > to one of supported values by the driver, so instead of removing
> > how about changing the above line to:
> >
> >          if (i < 0)
> >                  mf->code = camif_mbus_formats[0];
> >
> > ?
> That would still have one of the two out-of-bounds accesses;-)

Ah, indeed :/

> maybe this
>
> for (i = 0; i < ARRAY_SIZE(camif_mbus_formats); i++)
>          if (camif_mbus_formats[i] == mf->code)
>                 break;
>
> if (i == ARRAY_SIZE(camif_mbus_formats))
>         mf->code = camif_mbus_formats[0];

Yes, it should work that way.

--
Thanks,
Sylwester