[media] vivid: sanitize selection rectangle

Handle values like ~0 as width, height, left or top fields.
Just strip off the top 16 bits will ensure that the calculations
remain OK.

Found with v4l2-compliance.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c
index 283b2e861b79358a811c1b6bdbe5a1631e162dcb..53f0c1da940c88f349c75b7f90b0fa25cfeff2e5 100644 (file)
--- a/drivers/media/platform/vivid/vivid-vid-common.c
+++ b/drivers/media/platform/vivid/vivid-vid-common.c
@@ -694,6 +694,9 @@ int vivid_vid_adjust_sel(unsigned flags, struct v4l2_rect *r)
        unsigned w = r->width;
        unsigned h = r->height;
 
+       /* sanitize w and h in case someone passes ~0 as the value */
+       w &= 0xffff;
+       h &= 0xffff;
        if (!(flags & V4L2_SEL_FLAG_LE)) {
                w++;
                h++;
@@ -718,8 +721,9 @@ int vivid_vid_adjust_sel(unsigned flags, struct v4l2_rect *r)
                r->top = 0;
        if (r->left < 0)
                r->left = 0;
-       r->left &= ~1;
-       r->top &= ~1;
+       /* sanitize left and top in case someone passes ~0 as the value */
+       r->left &= 0xfffe;
+       r->top &= 0xfffe;
        if (r->left + w > MAX_WIDTH)
                r->left = MAX_WIDTH - w;
        if (r->top + h > MAX_HEIGHT)