summaryrefslogtreecommitdiffstats
path: root/drivers/media/platform/vivid/vivid-vid-common.c
diff options
context:
space:
mode:
authorHans Verkuil <hans.verkuil@cisco.com>2015-03-15 13:40:04 -0300
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>2015-04-02 21:10:45 -0300
commit82bdb26abcae2988c74be29203caf23dabbe4be3 (patch)
tree4fae28f342b03aa3ea8762ab3d82db1996a7846a /drivers/media/platform/vivid/vivid-vid-common.c
parent29813a6f34042da13d201694964d9dea3d4658ef (diff)
downloadlinux-82bdb26abcae2988c74be29203caf23dabbe4be3.tar.bz2
[media] vivid: sanitize selection rectangle
Handle values like ~0 as width, height, left or top fields. Just strip off the top 16 bits will ensure that the calculations remain OK. Found with v4l2-compliance. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media/platform/vivid/vivid-vid-common.c')
-rw-r--r--drivers/media/platform/vivid/vivid-vid-common.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c
index 283b2e861b79..53f0c1da940c 100644
--- a/drivers/media/platform/vivid/vivid-vid-common.c
+++ b/drivers/media/platform/vivid/vivid-vid-common.c
@@ -694,6 +694,9 @@ int vivid_vid_adjust_sel(unsigned flags, struct v4l2_rect *r)
unsigned w = r->width;
unsigned h = r->height;
+ /* sanitize w and h in case someone passes ~0 as the value */
+ w &= 0xffff;
+ h &= 0xffff;
if (!(flags & V4L2_SEL_FLAG_LE)) {
w++;
h++;
@@ -718,8 +721,9 @@ int vivid_vid_adjust_sel(unsigned flags, struct v4l2_rect *r)
r->top = 0;
if (r->left < 0)
r->left = 0;
- r->left &= ~1;
- r->top &= ~1;
+ /* sanitize left and top in case someone passes ~0 as the value */
+ r->left &= 0xfffe;
+ r->top &= 0xfffe;
if (r->left + w > MAX_WIDTH)
r->left = MAX_WIDTH - w;
if (r->top + h > MAX_HEIGHT)