Merge tag 'media/v5.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media updates from Mauro Carvalho Chehab:

 - New driver for SK Hynix Hi-846 8M pixel camera

 - New driver for the ov13b10 camera

 - New driver for Renesas R-Car ISP

 - mtk-vcodec gained support for version 2 of decoder firmware ABI

 - The legacy sir_ir driver got removed

 - videobuf2: the vb2_mem_ops kAPI had some improvements

 - lots of cleanups, fixes and new features at device drivers

* tag 'media/v5.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (328 commits)
  media: venus: core: Add sdm660 DT compatible and resource struct
  media: dt-bindings: media: venus: Add sdm660 dt schema
  media: venus: vdec: decoded picture buffer handling during reconfig sequence
  media: venus: Handle fatal errors during encoding and decoding
  media: venus: helpers: Add helper to mark fatal vb2 error
  media: venus: hfi: Check for sys error on session hfi functions
  media: venus: Make sys_error flag an atomic bitops
  media: venus: venc: Use pmruntime autosuspend
  media: allegro: write vui parameters for HEVC
  media: allegro: nal-hevc: implement generator for vui
  media: allegro: write correct colorspace into SPS
  media: allegro: extract nal value lookup functions to header
  media: allegro: correctly scale the bit rate in SPS
  media: allegro: remove external QP table
  media: allegro: fix row and column in response message
  media: allegro: add control to disable encoder buffer
  media: allegro: add encoder buffer support
  media: allegro: add pm_runtime support
  media: allegro: lookup VCU settings
  media: allegro: fix module removal if initialization failed
  ...

1 files changed, 11 insertions, 3 deletions

diff --git a/drivers/media/firewire/firedtv-avc.c b/drivers/media/firewire/firedtv-avc.c
index 2bf9467b917d..71991f8638e6 100644
--- a/drivers/media/firewire/firedtv-avc.c
+++ b/drivers/media/firewire/firedtv-avc.c
@@ -1165,7 +1165,11 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
 		read_pos += program_info_length;
 		write_pos += program_info_length;
 	}
-	while (read_pos < length) {
+	while (read_pos + 4 < length) {
+		if (write_pos + 4 >= sizeof(c->operand) - 4) {
+			ret = -EINVAL;
+			goto out;
+		}
 		c->operand[write_pos++] = msg[read_pos++];
 		c->operand[write_pos++] = msg[read_pos++];
 		c->operand[write_pos++] = msg[read_pos++];
@@ -1177,13 +1181,17 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
 		c->operand[write_pos++] = es_info_length >> 8;
 		c->operand[write_pos++] = es_info_length & 0xff;
 		if (es_info_length > 0) {
+			if (read_pos >= length) {
+				ret = -EINVAL;
+				goto out;
+			}
 			pmt_cmd_id = msg[read_pos++];
 			if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
 				dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n",
 					pmt_cmd_id);
 
-			if (es_info_length > sizeof(c->operand) - 4 -
-					     write_pos) {
+			if (es_info_length > sizeof(c->operand) - 4 - write_pos ||
+			    es_info_length > length - read_pos) {
 				ret = -EINVAL;
 				goto out;
 			}