sergiotarxz/nuttx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

drivers/video: Avoid additional overflow cases

Browse Source 
Add clip size validation to avoid additional overflow.
This commit is contained in:
SPRESENSE 2022-03-29 11:11:40 +09:00 committed by Petro Karashchenko
parent 1212d3b7d8
commit b296494fb8
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/video/video.c
View File

@ -1324,6 +1324,16 @@ static int video_cancel_dqbuf(FAR struct video_mng_s *vmng,
return OK; return OK;
} }
static bool validate_clip_range(int32_t pos, uint32_t c_sz, uint16_t frm_sz)
{
if ((pos < 0) || (c_sz > frm_sz) || (pos + c_sz > frm_sz))
{
return false;
}
return true;
}
static bool validate_clip_setting(FAR struct v4l2_rect *clip, static bool validate_clip_setting(FAR struct v4l2_rect *clip,
FAR video_format_t *fmt) FAR video_format_t *fmt)
{ {
@ -1333,10 +1343,8 @@ static bool validate_clip_setting(FAR struct v4l2_rect *clip,
/* Not permit the setting which do not fit inside frame size. */ /* Not permit the setting which do not fit inside frame size. */
if ((clip->left < 0) || if (!validate_clip_range(clip->left, clip->width, fmt->width) ||
(clip->top < 0) || !validate_clip_range(clip->top, clip->height, fmt->height))
(clip->left + clip->width > fmt->width) ||
(clip->top + clip->height > fmt->height))
{ {
ret = false; ret = false;
} }