diff --git a/drivers/media/platform/imx8/mxc-jpeg.c b/drivers/media/platform/imx8/mxc-jpeg.c index ab0f81757c43a7aac1648c454da3f5bf187b2315..a1d515a95eab4fd4acf8818df4cc4de695905fa4 100644 --- a/drivers/media/platform/imx8/mxc-jpeg.c +++ b/drivers/media/platform/imx8/mxc-jpeg.c @@ -692,6 +692,23 @@ static u8 get_sof(struct device *dev, return 0; } +static int mxc_jpeg_valid_comp_id( + struct device *dev, + const struct mxc_jpeg_sof *sof) +{ + int valid = 1; + int i; + + for (i = 0; i < sof->components_no; i++) + if (sof->comp[i].id > MXC_JPEG_MAX_COMPONENTS) { + valid = 0; + dev_err(dev, "Component %d has invalid ID: %d", + i, sof->comp[i].id); + } + + return valid; +} + static enum mxc_jpeg_image_format mxc_jpeg_get_image_format( struct device *dev, const struct mxc_jpeg_sof *sof) @@ -825,6 +842,15 @@ static int mxc_jpeg_parse(struct mxc_jpeg_ctx *ctx, sof.width, sof.height); return -EINVAL; } + if (sof.components_no > MXC_JPEG_MAX_COMPONENTS) { + dev_err(dev, "JPEG number of components should be <=%d", + MXC_JPEG_MAX_COMPONENTS); + return -EINVAL; + } + if (!mxc_jpeg_valid_comp_id(dev, &sof)) { + dev_err(dev, "JPEG component identifiers should be 0-3 or 1-4"); + return -EINVAL; + } desc->imgsize = sof.width << 16 | sof.height; dev_dbg(dev, "JPEG imgsize = 0x%x (%dx%d)\n", desc->imgsize, sof.width, sof.height); diff --git a/drivers/media/platform/imx8/mxc-jpeg.h b/drivers/media/platform/imx8/mxc-jpeg.h index f3e987e7d39b20780d381806ba0fc402591b15ec..5b5fdd25275cd1759777cb354b56448a0be5ee0d 100644 --- a/drivers/media/platform/imx8/mxc-jpeg.h +++ b/drivers/media/platform/imx8/mxc-jpeg.h @@ -123,6 +123,7 @@ struct mxc_jpeg_dev { struct mxc_jpeg_slot_data slot_data[MXC_MAX_SLOTS]; }; +#define MXC_JPEG_MAX_COMPONENTS 4 /* JPEG Start Of Frame marker fields*/ struct mxc_jpeg_sof_comp { u8 id; /*component id*/ @@ -136,7 +137,7 @@ struct mxc_jpeg_sof { u8 precision; u16 height, width; u8 components_no; - struct mxc_jpeg_sof_comp comp[4]; + struct mxc_jpeg_sof_comp comp[MXC_JPEG_MAX_COMPONENTS]; } __packed; #endif