From nobody Sun Dec 14 06:23:45 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38C5BC00140 for ; Mon, 15 Aug 2022 19:02:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242622AbiHOTCm (ORCPT ); Mon, 15 Aug 2022 15:02:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48712 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245219AbiHOS5C (ORCPT ); Mon, 15 Aug 2022 14:57:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1DC8148EB6; Mon, 15 Aug 2022 11:32:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B14BA61070; Mon, 15 Aug 2022 18:32:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C4C0C433C1; Mon, 15 Aug 2022 18:32:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1660588325; bh=IHCGDqu5bwcqLCvp1VkhijS+mn/FWgB8orbf0bZ0ZjI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jSE6Z5EOcnIeGUGXe9FdvbKsvqM8OM09FQ2PTIsPrH0oKfvw08ysDzy7rT+4Zpiy+ VcjdjDwcCjGBV0gV3R96KbH72V+7bb7oGFkIE9y1CwlzJCvxncZrf79OlUEjZnJHGN tWk6mZRmeL6XoBkmM5O7ikKd/++36i80ggBsXodk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jernej Skrabec , Ezequiel Garcia , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 5.15 367/779] media: cedrus: hevc: Add check for invalid timestamp Date: Mon, 15 Aug 2022 20:00:11 +0200 Message-Id: <20220815180352.941967383@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220815180337.130757997@linuxfoundation.org> References: <20220815180337.130757997@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jernej Skrabec [ Upstream commit 143201a6435bf65f0115435e9dc6d95c66b908e9 ] Not all DPB entries will be used most of the time. Unused entries will thus have invalid timestamps. They will produce negative buffer index which is not specifically handled. This works just by chance in current code. It will even produce bogus pointer, but since it's not used, it won't do any harm. Let's fix that brittle design by skipping writing DPB entry altogether if timestamp is invalid. Fixes: 86caab29da78 ("media: cedrus: Add HEVC/H.265 decoding support") Signed-off-by: Jernej Skrabec Reviewed-by: Ezequiel Garcia Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/staging/media/sunxi/cedrus/cedrus_h265.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c b/drivers/sta= ging/media/sunxi/cedrus/cedrus_h265.c index f2cec43fd1f0..830cae03fc6e 100644 --- a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c +++ b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c @@ -147,6 +147,9 @@ static void cedrus_h265_frame_info_write_dpb(struct ced= rus_ctx *ctx, dpb[i].pic_order_cnt[1] }; =20 + if (buffer_index < 0) + continue; + cedrus_h265_frame_info_write_single(ctx, i, dpb[i].field_pic, pic_order_cnt, buffer_index); --=20 2.35.1