[media] mx2-camera: potential negative underflow bug
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 18 Sep 2014 12:23:36 +0000 (09:23 -0300)
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>
Fri, 26 Sep 2014 09:47:43 +0000 (06:47 -0300)
commit5d6de11c331d61dd27cf02f54243ebd1fcfbbfb3
treed75c3268671388c68d4ae20df6a884bc1200ac91
parent197a47f2d51022c613bc7bf40953a0fa3497b9c5
[media] mx2-camera: potential negative underflow bug

My static checker complains:

drivers/media/platform/soc_camera/mx2_camera.c:1070
mx2_emmaprp_resize() warn: no lower bound on 'num'

The heuristic is that it's looking for values which the user can
influence and we put an upper bound on them but we (perhaps
accidentally) allow negative numbers.

I am not very familiar with this code but I have looked at it and think
there might be a bug.  Making the variable unsigned seems like a safe
option either way and this silences the static checker warning.

The call tree is:
  -> subdev_do_ioctl()
     -> mx2_camera_set_fmt()
        -> mx2_emmaprp_resize()
The check:
if (num > RESIZE_NUM_MAX)
can underflow and then we use "num" on the else path.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/platform/soc_camera/mx2_camera.c