diff options
author | Liu Ying <b17645@freescale.com> | 2010-10-27 09:48:21 +0800 |
---|---|---|
committer | Liu Ying <b17645@freescale.com> | 2010-10-27 09:48:21 +0800 |
commit | 40a72bed068e55b641a41cab3b17cd04999f7d8c (patch) | |
tree | facf9e846393567167f1a49fe62639b3acb207d8 /drivers/media/video | |
parent | 958a3b70a70ecd0824177875d76b09c2370257a3 (diff) |
ENGR00132990 MXC V4L2 capture:Check zero width/height in VIDIOC_S_FMT
This patch checks zero width/height parameters provided by user
in ioctrl VIDIOC_S_FMT. It can fix the issue of division by zero
in kernel in this case.
Signed-off-by: Liu Ying <b17645@freescale.com>
Diffstat (limited to 'drivers/media/video')
-rw-r--r-- | drivers/media/video/mxc/capture/mxc_v4l2_capture.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/media/video/mxc/capture/mxc_v4l2_capture.c b/drivers/media/video/mxc/capture/mxc_v4l2_capture.c index 8616cfe4ae59..0cb8a95f48ef 100644 --- a/drivers/media/video/mxc/capture/mxc_v4l2_capture.c +++ b/drivers/media/video/mxc/capture/mxc_v4l2_capture.c @@ -498,6 +498,12 @@ static int verify_preview(cam_data *cam, struct v4l2_window *win) height = &win->w.height; } + if (*width == 0 || *height == 0) { + pr_err("ERROR: v4l2 capture: width or height" + " too small.\n"); + return -EINVAL; + } + if ((cam->crop_bounds.width / *width > 8) || ((cam->crop_bounds.width / *width == 8) && (cam->crop_bounds.width % *width))) { @@ -727,6 +733,12 @@ static int mxc_v4l2_s_fmt(cam_data *cam, struct v4l2_format *f) *width -= *width % 8; *height -= *height % 8; + if (*width == 0 || *height == 0) { + pr_err("ERROR: v4l2 capture: width or height" + " too small.\n"); + return -EINVAL; + } + if ((cam->crop_current.width / *width > 8) || ((cam->crop_current.width / *width == 8) && (cam->crop_current.width % *width))) { |