diff mbox series

media: pispbe: Protect against left-shift wrap in V4L2_COLORSPACE_MASK()

Message ID 20240715102425.1244918-1-naush@raspberrypi.com
State New
Headers show
Series media: pispbe: Protect against left-shift wrap in V4L2_COLORSPACE_MASK() | expand

Commit Message

Naushir Patuck July 15, 2024, 10:24 a.m. UTC 
Ensure that the user requested colorspace value does not wrap when
using the V4L2_COLORSPACE_MASK() macro. If the requested colorspace
value >= BIT_PER_LONG, revert to the default colorspace for the given
format.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
---
 drivers/media/platform/raspberrypi/pisp_be/pisp_be.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c b/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
index e74df5b116dc..bd5d77c691d3 100644
--- a/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
+++ b/drivers/media/platform/raspberrypi/pisp_be/pisp_be.c
@@ -1124,8 +1124,9 @@  static void pispbe_try_format(struct v4l2_format *f, struct pispbe_node *node)
 	 * not supported. This also catches the case when the "default"
 	 * colour space was requested (as that's never in the mask).
 	 */
-	if (!(V4L2_COLORSPACE_MASK(f->fmt.pix_mp.colorspace) &
-	    fmt->colorspace_mask))
+	if (f->fmt.pix_mp.colorspace >= BITS_PER_LONG ||
+	    !(V4L2_COLORSPACE_MASK(f->fmt.pix_mp.colorspace) &
+	      fmt->colorspace_mask))
 		f->fmt.pix_mp.colorspace = fmt->colorspace_default;
 
 	/* In all cases, we only support the defaults for these: */