Skip to content

Commit

Permalink
[media] sr030pc30: don't read a new pointer
Browse files Browse the repository at this point in the history
sr030pc30_get_fmt() can only succeed if both info->curr_win and
info->curr_fmt are not NULL.

If one of those vars are null, the curent code would call:
	ret = sr030pc30_set_params(sd);

If the curr_win is null, it will return -EINVAL, as it would be
expected. However, if curr_fmt is NULL, the function won't
set it.

The code will then try to read from it:

        mf->code        = info->curr_fmt->code;
        mf->colorspace  = info->curr_fmt->colorspace;

with obviouly won't work.

This got reported by smatch:
	drivers/media/i2c/sr030pc30.c:505 sr030pc30_get_fmt() error: we previously assumed 'info->curr_win' could be null (see line 499)
	drivers/media/i2c/sr030pc30.c:507 sr030pc30_get_fmt() error: we previously assumed 'info->curr_fmt' could be null (see line 499)

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
  • Loading branch information
Mauro Carvalho Chehab committed Aug 16, 2015
1 parent ab9a953 commit 27c0397
Showing 1 changed file with 2 additions and 6 deletions.
8 changes: 2 additions & 6 deletions drivers/media/i2c/sr030pc30.c
Original file line number Diff line number Diff line change
Expand Up @@ -489,18 +489,14 @@ static int sr030pc30_get_fmt(struct v4l2_subdev *sd,
{
struct v4l2_mbus_framefmt *mf;
struct sr030pc30_info *info = to_sr030pc30(sd);
int ret;

if (!format || format->pad)
return -EINVAL;

mf = &format->format;

if (!info->curr_win || !info->curr_fmt) {
ret = sr030pc30_set_params(sd);
if (ret)
return ret;
}
if (!info->curr_win || !info->curr_fmt)
return -EINVAL;

mf->width = info->curr_win->width;
mf->height = info->curr_win->height;
Expand Down

0 comments on commit 27c0397

Please sign in to comment.