On 16/10/2024 12:22, Mauro Carvalho Chehab wrote:
> The logic at tpg_precalculate_line() blindly rescales the
> buffer even when scaled_witdh is equal to zero. If this ever
scaled_witdh -> scaled_width
> happens, this will cause a division by zero.
>
> Instead, add a WARN_ON() to trigger such cases and return
> without doing any precalculation.
>
> Fixes: 63881df94d3e ("[media] vivid: add the Test Pattern Generator")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
> ---
> drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
> index c86343a4d0bf..a22f31515d7e 100644
> --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
> +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
> @@ -1795,6 +1795,9 @@ static void tpg_precalculate_line(struct tpg_data *tpg)
> unsigned p;
> unsigned x;
>
> + if (WARN_ON(tpg->src_width == 0))
You need to check for both src_width and scaled_width.
Also replace this by WARN_ON_ONCE.
Regards,
Hans
> + return;
> +
> switch (tpg->pattern) {
> case TPG_PAT_GREEN:
> contrast = TPG_COLOR_100_RED;
