diff options
| author | Liu Ying <b17645@freescale.com> | 2010-10-27 09:48:21 +0800 |
|---|---|---|
| committer | Lily Zhang <r58066@freescale.com> | 2010-10-27 16:00:33 +0800 |
| commit | 5297e39a55cf9011ab67ed380b01e11e3323a9a9 (patch) | |
| tree | 7af3cda85eb3ac689831f9866f72014981c967e8 | |
| parent | 080a813ae04b421d4e006964afc55762b94a6cfd (diff) | |
ENGR00132990 MXC V4L2 capture:Check zero width/height in VIDIOC_S_FMT
This patch checks zero width/height parameters provided by user
in ioctrl VIDIOC_S_FMT. It can fix the issue of division by zero
in kernel in this case.
Signed-off-by: Liu Ying <b17645@freescale.com>
(cherry picked from commit 40a72bed068e55b641a41cab3b17cd04999f7d8c)
| -rw-r--r-- | drivers/media/video/mxc/capture/mxc_v4l2_capture.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/media/video/mxc/capture/mxc_v4l2_capture.c b/drivers/media/video/mxc/capture/mxc_v4l2_capture.c index 8616cfe4ae59..0cb8a95f48ef 100644 --- a/drivers/media/video/mxc/capture/mxc_v4l2_capture.c +++ b/drivers/media/video/mxc/capture/mxc_v4l2_capture.c @@ -498,6 +498,12 @@ static int verify_preview(cam_data *cam, struct v4l2_window *win) height = &win->w.height; } + if (*width == 0 || *height == 0) { + pr_err("ERROR: v4l2 capture: width or height" + " too small.\n"); + return -EINVAL; + } + if ((cam->crop_bounds.width / *width > 8) || ((cam->crop_bounds.width / *width == 8) && (cam->crop_bounds.width % *width))) { @@ -727,6 +733,12 @@ static int mxc_v4l2_s_fmt(cam_data *cam, struct v4l2_format *f) *width -= *width % 8; *height -= *height % 8; + if (*width == 0 || *height == 0) { + pr_err("ERROR: v4l2 capture: width or height" + " too small.\n"); + return -EINVAL; + } + if ((cam->crop_current.width / *width > 8) || ((cam->crop_current.width / *width == 8) && (cam->crop_current.width % *width))) { |