From 27c039750c8ff1297632e424a4674732cc4c3c70 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Tue, 11 Aug 2015 12:18:33 -0300 Subject: [PATCH] [media] sr030pc30: don't read a new pointer sr030pc30_get_fmt() can only succeed if both info->curr_win and info->curr_fmt are not NULL. If one of those vars are null, the curent code would call: ret = sr030pc30_set_params(sd); If the curr_win is null, it will return -EINVAL, as it would be expected. However, if curr_fmt is NULL, the function won't set it. The code will then try to read from it: mf->code = info->curr_fmt->code; mf->colorspace = info->curr_fmt->colorspace; with obviouly won't work. This got reported by smatch: drivers/media/i2c/sr030pc30.c:505 sr030pc30_get_fmt() error: we previously assumed 'info->curr_win' could be null (see line 499) drivers/media/i2c/sr030pc30.c:507 sr030pc30_get_fmt() error: we previously assumed 'info->curr_fmt' could be null (see line 499) Signed-off-by: Mauro Carvalho Chehab --- drivers/media/i2c/sr030pc30.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/drivers/media/i2c/sr030pc30.c b/drivers/media/i2c/sr030pc30.c index 229dc76c44a5..b04c09dd4bfb 100644 --- a/drivers/media/i2c/sr030pc30.c +++ b/drivers/media/i2c/sr030pc30.c @@ -489,18 +489,14 @@ static int sr030pc30_get_fmt(struct v4l2_subdev *sd, { struct v4l2_mbus_framefmt *mf; struct sr030pc30_info *info = to_sr030pc30(sd); - int ret; if (!format || format->pad) return -EINVAL; mf = &format->format; - if (!info->curr_win || !info->curr_fmt) { - ret = sr030pc30_set_params(sd); - if (ret) - return ret; - } + if (!info->curr_win || !info->curr_fmt) + return -EINVAL; mf->width = info->curr_win->width; mf->height = info->curr_win->height;