Thank you for the advice Andy.
I took a look in overflow.h and found the size_mul function, I assume this
is what I should be using to prevent accidental overflow.
I also removed the inline keyword from the function definitions because
Dan (error27@xxxxxxxxx) recommended that I do so in reply to an earlier
patch I submitted.
Signed-off-by: Brent Pappas <bpappas@xxxxxxxxxxxxxxx>
---
Changelog:
V1 -> V2: Use size_mul to perform size_t multiplication without risk of
overflow.
Remove the inline keyword from function definitions.
.../staging/media/atomisp/pci/sh_css_params.c | 38 +++++++++++--------
1 file changed, 23 insertions(+), 15 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_params.c b/drivers/staging/media/atomisp/pci/sh_css_params.c
index f08564f58242..7e111df5c09d 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_params.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_params.c
@@ -98,17 +98,27 @@
#include "sh_css_frac.h"
#include "ia_css_bufq.h"
-#define FPNTBL_BYTES(binary) \
- (sizeof(char) * (binary)->in_frame_info.res.height * \
- (binary)->in_frame_info.padded_width)
+static size_t fpntbl_bytes(const struct ia_css_binary *binary)
+{
+ return size_mul(sizeof(char),
+ size_mul(binary->in_frame_info.res.height,
+ binary->in_frame_info.padded_width));
+}
-#define SCTBL_BYTES(binary) \
- (sizeof(unsigned short) * (binary)->sctbl_height * \
- (binary)->sctbl_aligned_width_per_color * IA_CSS_SC_NUM_COLORS)
+static size_t sctbl_bytes(const struct ia_css_binary *binary)
+{
+ return size_mul(sizeof(unsigned short),
+ size_mul(binary->sctbl_height,
+ size_mul(binary->sctbl_aligned_width_per_color,
+ IA_CSS_SC_NUM_COLORS)));
+}
-#define MORPH_PLANE_BYTES(binary) \
- (SH_CSS_MORPH_TABLE_ELEM_BYTES * (binary)->morph_tbl_aligned_width * \
- (binary)->morph_tbl_height)
+static size_t morph_plane_bytes(const struct ia_css_binary *binary)
+{
+ return size_mul(SH_CSS_MORPH_TABLE_ELEM_BYTES,
+ size_mul(binary->morph_tbl_aligned_width,
+ binary->morph_tbl_height));
+}
/* We keep a second copy of the ptr struct for the SP to access.
Again, this would not be necessary on the chip. */
@@ -3279,7 +3289,7 @@ sh_css_params_write_to_ddr_internal(
if (binary->info->sp.enable.fpnr) {
buff_realloced = reallocate_buffer(&ddr_map->fpn_tbl,
&ddr_map_size->fpn_tbl,
- (size_t)(FPNTBL_BYTES(binary)),
+ fpntbl_bytes(binary),
params->config_changed[IA_CSS_FPN_ID],
&err);
if (err) {
@@ -3304,7 +3314,7 @@ sh_css_params_write_to_ddr_internal(
buff_realloced = reallocate_buffer(&ddr_map->sc_tbl,
&ddr_map_size->sc_tbl,
- SCTBL_BYTES(binary),
+ sctbl_bytes(binary),
params->sc_table_changed,
&err);
if (err) {
@@ -3538,8 +3548,7 @@ sh_css_params_write_to_ddr_internal(
buff_realloced |=
reallocate_buffer(virt_addr_tetra_x[i],
virt_size_tetra_x[i],
- (size_t)
- (MORPH_PLANE_BYTES(binary)),
+ morph_plane_bytes(binary),
params->morph_table_changed,
&err);
if (err) {
@@ -3549,8 +3558,7 @@ sh_css_params_write_to_ddr_internal(
buff_realloced |=
reallocate_buffer(virt_addr_tetra_y[i],
virt_size_tetra_y[i],
- (size_t)
- (MORPH_PLANE_BYTES(binary)),
+ morph_plane_bytes(binary),
params->morph_table_changed,
&err);
if (err) {
--
2.34.1
