Commit 4a92fc6e authored by Tom Rix's avatar Tom Rix Committed by Mauro Carvalho Chehab
Browse files

media: video/hdmi: handle short reads of hdmi info frame. 



Calling hdmi_infoframe_unpack() with static sizeof(buffer) skips all
the size checking done later in hdmi_infoframe_unpack().  A better
value is the amount of data read into buffer.

Fixes: 480b8b3e ("video/hdmi: Pass buffer size to infoframe unpack functions")
Signed-off-by: default avatarTom Rix <trix@redhat.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent 4a2e0a80

drivers/media/i2c/adv7511-v4l2.c

+1 −1
Original line number Diff line number Diff line
@@ -522,7 +522,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_ 
	buffer[3] = 0;

	buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);



	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {

	if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) {

		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);

		return;

	}

drivers/media/i2c/adv7604.c

+1 −1
Original line number Diff line number Diff line
@@ -2484,7 +2484,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index, 
		buffer[i + 3] = infoframe_read(sd,

				       adv76xx_cri[index].payload_addr + i);



	if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) {

	if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) {

		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__,

			 adv76xx_cri[index].desc);

		return -ENOENT;

drivers/media/i2c/adv7842.c

+1 −1
Original line number Diff line number Diff line
@@ -2583,7 +2583,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7842_cfg_read_ 
	for (i = 0; i < len; i++)

		buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i);



	if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {

	if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) {

		v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);

		return;

	}