From b9051c938e69cef56cdfbb663c582703655d99a0 Mon Sep 17 00:00:00 2001 From: Jacek Anaszewski Date: Fri, 28 Nov 2014 14:08:07 +0100 Subject: s5p-jpeg: Fix possible NULL pointer dereference in s_fmt Some formats are not supported in encoding or decoding mode for given type of buffer (e.g. V4L2_PIX_FMT_JPEG is supported on output buffer only while in decoding mode). Make S_FMT failing if not suitable format is found. Change-Id: I35c94e38b1b11e2c379f4b2e1f61eedab2bc0a9d Signed-off-by: Jacek Anaszewski --- drivers/media/platform/s5p-jpeg/jpeg-core.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'drivers') diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c index 91dc35186c5..09576040277 100644 --- a/drivers/media/platform/s5p-jpeg/jpeg-core.c +++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c @@ -1345,6 +1345,14 @@ static int s5p_jpeg_s_fmt(struct s5p_jpeg_ctx *ct, struct v4l2_format *f) FMT_TYPE_OUTPUT : FMT_TYPE_CAPTURE; q_data->fmt = s5p_jpeg_find_format(ct, pix->pixelformat, f_type); + + if (!q_data->fmt) { + v4l2_err(&ct->jpeg->v4l2_dev, + "Fourcc format (0x%08x) invalid.\n", + f->fmt.pix.pixelformat); + return -EINVAL; + } + q_data->w = pix->width; q_data->h = pix->height; if (q_data->fmt->fourcc != V4L2_PIX_FMT_JPEG) { -- cgit v1.2.3