aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMauro Carvalho Chehab <mchehab@osg.samsung.com>2015-08-11 11:18:33 -0400
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>2015-08-16 11:58:31 -0400
commit27c039750c8ff1297632e424a4674732cc4c3c70 (patch)
tree13cac825fc3bcd19df5094a048e36070ee110755
parentab9a953b9f58ae695bbbe04a8540830bbae5d246 (diff)
[media] sr030pc30: don't read a new pointer
sr030pc30_get_fmt() can only succeed if both info->curr_win and info->curr_fmt are not NULL. If one of those vars are null, the curent code would call: ret = sr030pc30_set_params(sd); If the curr_win is null, it will return -EINVAL, as it would be expected. However, if curr_fmt is NULL, the function won't set it. The code will then try to read from it: mf->code = info->curr_fmt->code; mf->colorspace = info->curr_fmt->colorspace; with obviouly won't work. This got reported by smatch: drivers/media/i2c/sr030pc30.c:505 sr030pc30_get_fmt() error: we previously assumed 'info->curr_win' could be null (see line 499) drivers/media/i2c/sr030pc30.c:507 sr030pc30_get_fmt() error: we previously assumed 'info->curr_fmt' could be null (see line 499) Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
-rw-r--r--drivers/media/i2c/sr030pc30.c8
1 files changed, 2 insertions, 6 deletions
diff --git a/drivers/media/i2c/sr030pc30.c b/drivers/media/i2c/sr030pc30.c
index 229dc76c44a5..b04c09dd4bfb 100644
--- a/drivers/media/i2c/sr030pc30.c
+++ b/drivers/media/i2c/sr030pc30.c
@@ -489,18 +489,14 @@ static int sr030pc30_get_fmt(struct v4l2_subdev *sd,
489{ 489{
490 struct v4l2_mbus_framefmt *mf; 490 struct v4l2_mbus_framefmt *mf;
491 struct sr030pc30_info *info = to_sr030pc30(sd); 491 struct sr030pc30_info *info = to_sr030pc30(sd);
492 int ret;
493 492
494 if (!format || format->pad) 493 if (!format || format->pad)
495 return -EINVAL; 494 return -EINVAL;
496 495
497 mf = &format->format; 496 mf = &format->format;
498 497
499 if (!info->curr_win || !info->curr_fmt) { 498 if (!info->curr_win || !info->curr_fmt)
500 ret = sr030pc30_set_params(sd); 499 return -EINVAL;
501 if (ret)
502 return ret;
503 }
504 500
505 mf->width = info->curr_win->width; 501 mf->width = info->curr_win->width;
506 mf->height = info->curr_win->height; 502 mf->height = info->curr_win->height;