Hi Hans,
On Sat, Dec 13, 2014 at 12:52:55PM +0100, Hans Verkuil wrote:
> From: Hans Verkuil <hans.verkuil@xxxxxxxxx>
>
> drivers/media/media-entity.c:238:17: warning: Variable length array is used.
> drivers/media/media-entity.c:239:17: warning: Variable length array is used.
>
> Replace variable length by MEDIA_ENTITY_ENUM_MAX_ID.
>
> Signed-off-by: Hans Verkuil <hans.verkuil@xxxxxxxxx>
> Cc: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>
> ---
> drivers/media/media-entity.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c
> index 4d8e01c..dcf322b 100644
> --- a/drivers/media/media-entity.c
> +++ b/drivers/media/media-entity.c
> @@ -235,8 +235,8 @@ __must_check int media_entity_pipeline_start(struct media_entity *entity,
> media_entity_graph_walk_start(&graph, entity);
>
> while ((entity = media_entity_graph_walk_next(&graph))) {
> - DECLARE_BITMAP(active, entity->num_pads);
> - DECLARE_BITMAP(has_no_links, entity->num_pads);
> + DECLARE_BITMAP(active, MEDIA_ENTITY_ENUM_MAX_ID);
> + DECLARE_BITMAP(has_no_links, MEDIA_ENTITY_ENUM_MAX_ID);
> unsigned int i;
>
> entity->stream_count++;
NAK.
MEDIA_ENTITY_ENUM_MAX_ID is the number of *entities* the graph parsing code
can handle, whereas the bitmap has to be large enough for the *pads* in an
entity.
There is no guarantee that the number of pads would be less than
MEDIA_ENTITY_ENUM_MAX_ID, which could lead to memory corruption. Also
MEDIA_ENTITY_ENUM_MAX_ID is probably about ten times as large as there
usually are pads.
What's wrong with using variable length arrays in general? Of course, there
needs to be a guarantee that the length is decently small, which is the case
in here.
We could define an upper limit for the number of pads, and check that the
number of pads actually is not greater than this.
--
Kind regards,
Sakari Ailus
e-mail: sakari.ailus@xxxxxx XMPP: sailus@xxxxxxxxxxxxxx
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
