diff options
| author | Guennadi Liakhovetski <g.liakhovetski@gmx.de> | 2012-05-08 11:46:44 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2012-05-15 16:14:01 -0300 |
| commit | 67e86524b907ed2189f4875cdbe7a5249c71ebb2 (patch) | |
| tree | 024321e97d066467df8b25fe92d59b6f2d244b9e | |
| parent | fc13baff743cf9fa49035974471c17378bfe6146 (diff) | |
[media] V4L: mx2-camera: avoid overflowing 32-bits
In mx2_camera_try_fmt(), when applying i.MX25 restrictions to frame sizes,
the height is checked to be <= 0xffff. But later an integer multiplication
height * 4 * 0x3ffff is performed, which will overflow even for bounded
height values. This patch switches to using 64-bit multiplication and
division to avoid overflowing.
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| -rw-r--r-- | drivers/media/video/mx2_camera.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/media/video/mx2_camera.c b/drivers/media/video/mx2_camera.c index ecd83faf903..ded26b7286f 100644 --- a/drivers/media/video/mx2_camera.c +++ b/drivers/media/video/mx2_camera.c @@ -22,6 +22,7 @@ #include <linux/gcd.h> #include <linux/interrupt.h> #include <linux/kernel.h> +#include <linux/math64.h> #include <linux/mm.h> #include <linux/moduleparam.h> #include <linux/time.h> @@ -1400,8 +1401,8 @@ static int mx2_camera_try_fmt(struct soc_camera_device *icd, /* Check against the CSIRXCNT limit */ if (pix->sizeimage > 4 * 0x3ffff) { /* Adjust geometry, preserve aspect ratio */ - unsigned int new_height = int_sqrt(4 * 0x3ffff * - pix->height / pix->bytesperline); + unsigned int new_height = int_sqrt(div_u64(0x3ffffULL * + 4 * pix->height, pix->bytesperline)); pix->width = new_height * pix->width / pix->height; pix->height = new_height; pix->bytesperline = soc_mbus_bytes_per_line(pix->width, |