Re: [PATCH] media: uvcvideo: Skip frame descriptors with a zero computed size

[Natasha Klaus <natalie.klaus@runtimeverification.com>]

Three more things on the refactor, from reading it rather than running it.

Placement: bufsize is declared at uvc_driver.c:300 and the block closes at 327,
while interval parsing runs 329-354, so at the proposed position the variable is
out of scope. And the exemption a check outside the branch would need is
format->flags & UVC_FMT_FLAG_COMPRESSED, which is the branch condition at line
299 itself.

The compressed case is worse than frame based alone. For UVC 1.10 and later
uvc_fixup_video_ctrl() at uvc_video.c:214-218 never consumes the descriptor value,
the size comes from the probe response. An MJPEG descriptor reporting zero is
inert on those devices today, so a check outside the branch would skip those
frames and break cameras that stream fine.

-ENODATA already appears in this driver with the opposite polarity, at
uvc_video.c:1284 and :1310, where it means drop this payload and carry on. Using
it for the fatal case reads backwards against that.

The mechanical parts of your refactor hold: buffer[0] cannot be zero because the
USB core truncates the config at the first bLength < 2 descriptor (config.c:706,
:785), the interval array is pre-counted at uvc_driver.c:718-729 with
*intervals += n after every skip return, and all frames[] access is positional.

Not tested on hardware. I will build and test before sending the series.

Natasha