Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

media: cx25840: fix a possible divide by zero in set_fmt callback

If set_fmt callback is called with format->width or format->height set to
zero and HACTIVE_CNT or VACTIVE_CNT bits (respectively) in chip are zero
we will divide by zero later in this callback when we try to calculate
HSC or VSC values.

Fix this by explicitly rejecting these values.

Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

authored by

Maciej S. Szmigiero and committed by
Mauro Carvalho Chehab
4f1bdf0a 7ff06130

+3 -2
+3 -2
drivers/media/i2c/cx25840/cx25840-core.c
··· 1395 1395 * height. Without that margin the cx23885 fails in this 1396 1396 * check. 1397 1397 */ 1398 - if ((fmt->width * 16 < Hsrc) || (Hsrc < fmt->width) || 1399 - (Vlines * 8 < Vsrc) || (Vsrc + 1 < Vlines)) { 1398 + if ((fmt->width == 0) || (Vlines == 0) || 1399 + (fmt->width * 16 < Hsrc) || (Hsrc < fmt->width) || 1400 + (Vlines * 8 < Vsrc) || (Vsrc + 1 < Vlines)) { 1400 1401 v4l_err(client, "%dx%d is not a valid size!\n", 1401 1402 fmt->width, fmt->height); 1402 1403 return -ERANGE;