diff options
author | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2015-08-11 11:18:33 -0400 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2015-08-16 11:58:31 -0400 |
commit | 27c039750c8ff1297632e424a4674732cc4c3c70 (patch) | |
tree | 13cac825fc3bcd19df5094a048e36070ee110755 | |
parent | ab9a953b9f58ae695bbbe04a8540830bbae5d246 (diff) |
[media] sr030pc30: don't read a new pointer
sr030pc30_get_fmt() can only succeed if both info->curr_win and
info->curr_fmt are not NULL.
If one of those vars are null, the curent code would call:
ret = sr030pc30_set_params(sd);
If the curr_win is null, it will return -EINVAL, as it would be
expected. However, if curr_fmt is NULL, the function won't
set it.
The code will then try to read from it:
mf->code = info->curr_fmt->code;
mf->colorspace = info->curr_fmt->colorspace;
with obviouly won't work.
This got reported by smatch:
drivers/media/i2c/sr030pc30.c:505 sr030pc30_get_fmt() error: we previously assumed 'info->curr_win' could be null (see line 499)
drivers/media/i2c/sr030pc30.c:507 sr030pc30_get_fmt() error: we previously assumed 'info->curr_fmt' could be null (see line 499)
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
-rw-r--r-- | drivers/media/i2c/sr030pc30.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/drivers/media/i2c/sr030pc30.c b/drivers/media/i2c/sr030pc30.c index 229dc76c44a5..b04c09dd4bfb 100644 --- a/drivers/media/i2c/sr030pc30.c +++ b/drivers/media/i2c/sr030pc30.c | |||
@@ -489,18 +489,14 @@ static int sr030pc30_get_fmt(struct v4l2_subdev *sd, | |||
489 | { | 489 | { |
490 | struct v4l2_mbus_framefmt *mf; | 490 | struct v4l2_mbus_framefmt *mf; |
491 | struct sr030pc30_info *info = to_sr030pc30(sd); | 491 | struct sr030pc30_info *info = to_sr030pc30(sd); |
492 | int ret; | ||
493 | 492 | ||
494 | if (!format || format->pad) | 493 | if (!format || format->pad) |
495 | return -EINVAL; | 494 | return -EINVAL; |
496 | 495 | ||
497 | mf = &format->format; | 496 | mf = &format->format; |
498 | 497 | ||
499 | if (!info->curr_win || !info->curr_fmt) { | 498 | if (!info->curr_win || !info->curr_fmt) |
500 | ret = sr030pc30_set_params(sd); | 499 | return -EINVAL; |
501 | if (ret) | ||
502 | return ret; | ||
503 | } | ||
504 | 500 | ||
505 | mf->width = info->curr_win->width; | 501 | mf->width = info->curr_win->width; |
506 | mf->height = info->curr_win->height; | 502 | mf->height = info->curr_win->height; |