MLK-19605: mxc-jpeg: RGB format in jpeg can't be decoded by mxc-jpeg driver

Validate the component ID's when parsing the jpeg headers,
print error and don't continue the decoding, avoid getting stuck.

Signed-off-by: Mirela Rabulea <mirela.rabulea@nxp.com>

diff --git a/drivers/media/platform/imx8/mxc-jpeg.c b/drivers/media/platform/imx8/mxc-jpeg.c
index ab0f817..a1d515a 100644 (file)
--- a/drivers/media/platform/imx8/mxc-jpeg.c
+++ b/drivers/media/platform/imx8/mxc-jpeg.c
@@ -692,6 +692,23 @@ static u8 get_sof(struct device *dev,
        return 0;
 }
 
+static int mxc_jpeg_valid_comp_id(
+       struct device *dev,
+       const struct mxc_jpeg_sof *sof)
+{
+       int valid = 1;
+       int i;
+
+       for (i = 0; i < sof->components_no; i++)
+               if (sof->comp[i].id > MXC_JPEG_MAX_COMPONENTS) {
+                       valid = 0;
+                       dev_err(dev, "Component %d has invalid ID: %d",
+                               i, sof->comp[i].id);
+               }
+
+       return valid;
+}
+
 static enum mxc_jpeg_image_format mxc_jpeg_get_image_format(
        struct device *dev,
        const struct mxc_jpeg_sof *sof)
@@ -825,6 +842,15 @@ static int mxc_jpeg_parse(struct mxc_jpeg_ctx *ctx,
                        sof.width, sof.height);
                return -EINVAL;
        }
+       if (sof.components_no > MXC_JPEG_MAX_COMPONENTS) {
+               dev_err(dev, "JPEG number of components should be <=%d",
+                       MXC_JPEG_MAX_COMPONENTS);
+               return -EINVAL;
+       }
+       if (!mxc_jpeg_valid_comp_id(dev, &sof)) {
+               dev_err(dev, "JPEG component identifiers should be 0-3 or 1-4");
+               return -EINVAL;
+       }
        desc->imgsize = sof.width << 16 | sof.height;
        dev_dbg(dev, "JPEG imgsize = 0x%x (%dx%d)\n", desc->imgsize,
                sof.width, sof.height);

diff --git a/drivers/media/platform/imx8/mxc-jpeg.h b/drivers/media/platform/imx8/mxc-jpeg.h
index f3e987e..5b5fdd2 100644 (file)
--- a/drivers/media/platform/imx8/mxc-jpeg.h
+++ b/drivers/media/platform/imx8/mxc-jpeg.h
@@ -123,6 +123,7 @@ struct mxc_jpeg_dev {
        struct mxc_jpeg_slot_data slot_data[MXC_MAX_SLOTS];
 };
 
+#define MXC_JPEG_MAX_COMPONENTS 4
 /* JPEG Start Of Frame marker fields*/
 struct mxc_jpeg_sof_comp {
        u8 id; /*component id*/
@@ -136,7 +137,7 @@ struct mxc_jpeg_sof {
        u8 precision;
        u16 height, width;
        u8 components_no;
-       struct mxc_jpeg_sof_comp comp[4];
+       struct mxc_jpeg_sof_comp comp[MXC_JPEG_MAX_COMPONENTS];
 } __packed;
 
 #endif