From: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
commit e6a3ea83fbe15d4818d01804e904cbb0e64e543b upstream.
As reported by Coverity, the logic at tpg_precalculate_line()
blindly rescales the buffer even when scaled_witdh is equal to
zero. If this ever happens, this will cause a division by zero.
Instead, add a WARN_ON_ONCE() to trigger such cases and return
without doing any precalculation.
Fixes: 63881df94d3e ("[media] vivid: add the Test Pattern Generator")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
@@ -1639,6 +1639,9 @@ static void tpg_precalculate_line(struct
unsigned p;
unsigned x;
+ if (WARN_ON_ONCE(!tpg->src_width || !tpg->scaled_width))
+ return;
+
switch (tpg->pattern) {
case TPG_PAT_GREEN:
contrast = TPG_COLOR_100_RED;
Patches currently in stable-queue which might be from mchehab+huawei@xxxxxxxxxx are
queue-4.19/media-dvb_frontend-don-t-play-tricks-with-underflow-.patch
queue-4.19/media-cx24116-prevent-overflows-on-snr-calculus.patch
queue-4.19/media-adv7604-prevent-underflow-condition-when-repor.patch
queue-4.19/media-dvbdev-prevent-the-risk-of-out-of-memory-acces.patch
queue-4.19/media-v4l2-tpg-prevent-the-risk-of-a-division-by-zero.patch
queue-4.19/media-s5p-jpeg-prevent-buffer-overflows.patch
queue-4.19/media-stb0899_algo-initialize-cfr-before-using-it.patch
