summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJacek Anaszewski <j.anaszewski@samsung.com>2014-11-28 14:08:07 +0100
committerJacek Anaszewski <j.anaszewski@samsung.com>2014-11-28 14:45:23 +0100
commitb9051c938e69cef56cdfbb663c582703655d99a0 (patch)
tree4a7ebfb2f7e5187cc4537b6f4d4198dea3687845
parent5eba78c5fe5ef86d387bfef9059ab69e48bfb829 (diff)
downloadlinux-3.10-b9051c938e69cef56cdfbb663c582703655d99a0.tar.gz
linux-3.10-b9051c938e69cef56cdfbb663c582703655d99a0.tar.bz2
linux-3.10-b9051c938e69cef56cdfbb663c582703655d99a0.zip
s5p-jpeg: Fix possible NULL pointer dereference in s_fmt
Some formats are not supported in encoding or decoding mode for given type of buffer (e.g. V4L2_PIX_FMT_JPEG is supported on output buffer only while in decoding mode). Make S_FMT failing if not suitable format is found. Change-Id: I35c94e38b1b11e2c379f4b2e1f61eedab2bc0a9d Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com>
-rw-r--r--drivers/media/platform/s5p-jpeg/jpeg-core.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index 91dc35186c5..09576040277 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -1345,6 +1345,14 @@ static int s5p_jpeg_s_fmt(struct s5p_jpeg_ctx *ct, struct v4l2_format *f)
FMT_TYPE_OUTPUT : FMT_TYPE_CAPTURE;
q_data->fmt = s5p_jpeg_find_format(ct, pix->pixelformat, f_type);
+
+ if (!q_data->fmt) {
+ v4l2_err(&ct->jpeg->v4l2_dev,
+ "Fourcc format (0x%08x) invalid.\n",
+ f->fmt.pix.pixelformat);
+ return -EINVAL;
+ }
+
q_data->w = pix->width;
q_data->h = pix->height;
if (q_data->fmt->fourcc != V4L2_PIX_FMT_JPEG) {