* [PATCH] media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
@ 2022-12-16 8:30 Ming Qian
0 siblings, 0 replies; only message in thread
From: Ming Qian @ 2022-12-16 8:30 UTC (permalink / raw)
To: mchehab, mirela.rabulea, hverkuil-cisco
Cc: shawnguo, s.hauer, kernel, festevam, xiahong.bao, linux-imx,
linux-media, linux-kernel, devicetree, linux-arm-kernel
The curr pointer has advanced 14 bytes in jpeg_parse_app14_data.
1. jpeg_get_word_be(stream), it goes forward 2 bytes.
2. jpeg_skip(stream, 11), it goes forward 11 bytes.
3. jpeg_get_byte(stream), it goes forward 1 bytes.
so the remain bytes of this segment should be (lp - 2 - 11 - 1),
but not (lp - 2 - 11).
if driver skip 1 extra bytes, the following parsing may go wrong.
Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
---
drivers/media/v4l2-core/v4l2-jpeg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c
index c2513b775f6a..75c2af763d55 100644
--- a/drivers/media/v4l2-core/v4l2-jpeg.c
+++ b/drivers/media/v4l2-core/v4l2-jpeg.c
@@ -474,7 +474,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream,
*tf = ret;
/* skip the rest of the segment, this ensures at least it is complete */
- skip = lp - 2 - 11;
+ skip = lp - 2 - 11 - 1;
return jpeg_skip(stream, skip);
}
--
2.38.1
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2022-12-16 8:31 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-16 8:30 [PATCH] media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data Ming Qian
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®