Hi, On 01/13/2011 11:05 PM, Jesper Juhl wrote:
usb_altnum_to_altsetting() may return NULL. If it does we'll dereference a NULL pointer in drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c::pb0100_start(). As far as I can tell there's not really anything more sensible than -ENODEV that we can return in that situation, but I'm not at all intimate with this code so I'd like a bit of review/comments on this before it's applied. Anyway, here's a proposed patch.
Hi, On 01/13/2011 11:05 PM, Jesper Juhl wrote: > usb_altnum_to_altsetting() may return NULL. If it does we'll dereference a > NULL pointer in > drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c::pb0100_start(). > As far as I can tell there's not really anything more sensible than > -ENODEV that we can return in that situation, but I'm not at all intimate > with this code so I'd like a bit of review/comments on this before it's > applied. > Anyway, here's a proposed patch. > pb0100_start gets called from stv06xx_start, which also does a usb_altnum_to_altsetting(intf, sd->gspca_dev.alt); and does contain the NULL check before calling pb0100_start. So I left out the check on purpose, to keep the code compact in IMHO better readable. Still I agree this is a bit tricky. So not NACK but not ACK either. What do others think? Regards, Hans
Signed-off-by: Jesper Juhl<jj@xxxxxxxxxxxxx> --- stv06xx_pb0100.c | 2 ++ 1 file changed, 2 insertions(+) compile tested only. diff --git a/drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c b/drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c index ac47b4c..75a5b9c 100644 --- a/drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c +++ b/drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c @@ -217,6 +217,8 @@ static int pb0100_start(struct sd *sd) intf = usb_ifnum_to_if(sd->gspca_dev.dev, sd->gspca_dev.iface); alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt); + if (!alt) + return -ENODEV; packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); /* If we don't have enough bandwidth use a lower framerate */
-- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
