| From 69d842db7531dc131fe94198141f91614206ee7e Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 12 Aug 2021 19:00:43 +0200 |
| Subject: media: TDA1997x: handle short reads of hdmi info frame. |
| |
| From: Tom Rix <trix@redhat.com> |
| |
| [ Upstream commit 48d219f9cc667bc6fbc3e3af0b1bfd75db94fce4 ] |
| |
| Static analysis reports this representative problem |
| |
| tda1997x.c:1939: warning: 7th function call argument is an uninitialized |
| value |
| |
| The 7th argument is buffer[0], which is set in the earlier call to |
| io_readn(). When io_readn() call to io_read() fails with the first |
| read, buffer[0] is not set and 0 is returned and stored in len. |
| |
| The later call to hdmi_infoframe_unpack()'s size parameter is the |
| static size of buffer, always 40, so a short read is not caught |
| in hdmi_infoframe_unpacks()'s checking. The variable len should be |
| used instead. |
| |
| Zero initialize buffer to 0 so it is in a known start state. |
| |
| Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver") |
| Signed-off-by: Tom Rix <trix@redhat.com> |
| Reviewed-by: Tim Harvey <tharvey@gateworks.com> |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/i2c/tda1997x.c | 8 ++++---- |
| 1 file changed, 4 insertions(+), 4 deletions(-) |
| |
| diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c |
| index 18a2027ba1450..5faffedb0feba 100644 |
| --- a/drivers/media/i2c/tda1997x.c |
| +++ b/drivers/media/i2c/tda1997x.c |
| @@ -1247,13 +1247,13 @@ tda1997x_parse_infoframe(struct tda1997x_state *state, u16 addr) |
| { |
| struct v4l2_subdev *sd = &state->sd; |
| union hdmi_infoframe frame; |
| - u8 buffer[40]; |
| + u8 buffer[40] = { 0 }; |
| u8 reg; |
| int len, err; |
| |
| /* read data */ |
| len = io_readn(sd, addr, sizeof(buffer), buffer); |
| - err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)); |
| + err = hdmi_infoframe_unpack(&frame, buffer, len); |
| if (err) { |
| v4l_err(state->client, |
| "failed parsing %d byte infoframe: 0x%04x/0x%02x\n", |
| @@ -1927,13 +1927,13 @@ static int tda1997x_log_infoframe(struct v4l2_subdev *sd, int addr) |
| { |
| struct tda1997x_state *state = to_state(sd); |
| union hdmi_infoframe frame; |
| - u8 buffer[40]; |
| + u8 buffer[40] = { 0 }; |
| int len, err; |
| |
| /* read data */ |
| len = io_readn(sd, addr, sizeof(buffer), buffer); |
| v4l2_dbg(1, debug, sd, "infoframe: addr=%d len=%d\n", addr, len); |
| - err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)); |
| + err = hdmi_infoframe_unpack(&frame, buffer, len); |
| if (err) { |
| v4l_err(state->client, |
| "failed parsing %d byte infoframe: 0x%04x/0x%02x\n", |
| -- |
| 2.33.0 |
| |