diff options
| author | Anastasia Belova <abelova@astralinux.ru> | 2024-02-05 18:23:50 +0300 |
|---|---|---|
| committer | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2024-08-25 08:15:24 +0200 |
| commit | c2c982def1a3a1963ebddd41cc70ee026cb8b765 (patch) | |
| tree | 0cc0097106c180d0b62dad8ea7bd1424284ea0fb /drivers/media/platform | |
| parent | a9fef294e8b1e53a7ea733576dd4788c84ec8a21 (diff) | |
media: coda: cast an operand of multiplication to a larger type
If the width and height are 0xffff (or close), the result of a
multiplication will overflow.
Cast to a larger type to avoid undefined behavior.
Such values are possible in CODA7, but unlikely.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 918c66fd4126 ("[media] coda: add CODA7541 decoding support")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Diffstat (limited to 'drivers/media/platform')
| -rw-r--r-- | drivers/media/platform/chips-media/coda/coda-bit.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/platform/chips-media/coda/coda-bit.c b/drivers/media/platform/chips-media/coda/coda-bit.c index ed47d5bd8d61..84ded154adfe 100644 --- a/drivers/media/platform/chips-media/coda/coda-bit.c +++ b/drivers/media/platform/chips-media/coda/coda-bit.c @@ -585,7 +585,7 @@ static int coda_alloc_context_buffers(struct coda_ctx *ctx, if (!ctx->slicebuf.vaddr && q_data->fourcc == V4L2_PIX_FMT_H264) { /* worst case slice size */ - size = (DIV_ROUND_UP(q_data->rect.width, 16) * + size = (unsigned long)(DIV_ROUND_UP(q_data->rect.width, 16) * DIV_ROUND_UP(q_data->rect.height, 16)) * 3200 / 8 + 512; ret = coda_alloc_context_buf(ctx, &ctx->slicebuf, size, "slicebuf"); |