diff options
| author |   Colin Ian King <colin.king@canonical.com> | 2020-07-22 15:09:03 +0200 |
|---|---|---|
| committer |   Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2020-08-06 11:28:04 +0200 |
| commit | 04320b3ef90bef04df6672e3a98a266b88c35b55 (patch) | |
| tree | 01cb6666e1b8a07a41c6d128303441f234f6ac11 /drivers/staging | |
| parent | media: mtk-mdp: Fix a refcounting bug on error in init (diff) | |
| download | linux-dev-04320b3ef90bef04df6672e3a98a266b88c35b55.tar.xz linux-dev-04320b3ef90bef04df6672e3a98a266b88c35b55.zip | |
media: allegro: fix potential null dereference on header
The pointer header is an alias to msg and msg is being null checked.
However, if msg is null then header is also null and this can lead to
a null pointer dereference on the assignment type = header->type. Fix
this just using header->type after the null check and removing the need
for type as it is only used once.
Addresses-Coverity: ("Dereference before null check")
Fixes: 3de16839669f ("media: allegro: add explicit mail encoding and decoding")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/media/allegro-dvt/allegro-mail.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/staging/media/allegro-dvt/allegro-mail.c b/drivers/staging/media/allegro-dvt/allegro-mail.c index 4ac65de12463..9286d2162377 100644 --- a/drivers/staging/media/allegro-dvt/allegro-mail.c +++ b/drivers/staging/media/allegro-dvt/allegro-mail.c @@ -462,13 +462,12 @@ allegro_dec_encode_frame(struct mcu_msg_encode_frame_response *msg, u32 *src) ssize_t allegro_encode_mail(u32 *dst, void *msg) { const struct mcu_msg_header *header = msg; - enum mcu_msg_type type = header->type; ssize_t size; if (!msg || !dst) return -EINVAL; - switch (type) { + switch (header->type) { case MCU_MSG_TYPE_INIT: size = allegro_enc_init(&dst[1], msg); break; |