From: Anastasia Belova Date: Mon, 5 Feb 2024 15:23:50 +0000 (+0300) Subject: media: coda: cast an operand of multiplication to a larger type X-Git-Tag: v6.12-rc1~82^2~91 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=c2c982def1a3a1963ebddd41cc70ee026cb8b765;p=linux-block.git media: coda: cast an operand of multiplication to a larger type If the width and height are 0xffff (or close), the result of a multiplication will overflow. Cast to a larger type to avoid undefined behavior. Such values are possible in CODA7, but unlikely. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 918c66fd4126 ("[media] coda: add CODA7541 decoding support") Signed-off-by: Anastasia Belova Signed-off-by: Sebastian Fricke Signed-off-by: Hans Verkuil --- diff --git a/drivers/media/platform/chips-media/coda/coda-bit.c b/drivers/media/platform/chips-media/coda/coda-bit.c index ed47d5bd8d61..84ded154adfe 100644 --- a/drivers/media/platform/chips-media/coda/coda-bit.c +++ b/drivers/media/platform/chips-media/coda/coda-bit.c @@ -585,7 +585,7 @@ static int coda_alloc_context_buffers(struct coda_ctx *ctx, if (!ctx->slicebuf.vaddr && q_data->fourcc == V4L2_PIX_FMT_H264) { /* worst case slice size */ - size = (DIV_ROUND_UP(q_data->rect.width, 16) * + size = (unsigned long)(DIV_ROUND_UP(q_data->rect.width, 16) * DIV_ROUND_UP(q_data->rect.height, 16)) * 3200 / 8 + 512; ret = coda_alloc_context_buf(ctx, &ctx->slicebuf, size, "slicebuf");