media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
authorMing Qian <ming.qian@nxp.com>
Fri, 16 Dec 2022 08:30:33 +0000 (09:30 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 10 Mar 2023 08:33:43 +0000 (09:33 +0100)
commit1cfbe44e0c7dac496e498d535e83fd442f215610
tree1012b4d208adf0f2a04f5ba683579d2136bed17e
parent972bd67c2c7bd226b11b2a05d138130677518c28
media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data

[ Upstream commit 41959c4f973b837a12061b84d3a436fc64c73a30 ]

The curr pointer has advanced 14 bytes in jpeg_parse_app14_data.
1. jpeg_get_word_be(stream), it goes forward 2 bytes.
2. jpeg_skip(stream, 11), it goes forward 11 bytes.
3. jpeg_get_byte(stream), it goes forward 1 bytes.

so the remain bytes of this segment should be (lp - 2 - 11 - 1),
but not (lp - 2 - 11).

if driver skip 1 extra bytes, the following parsing may go wrong.

Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/media/v4l2-core/v4l2-jpeg.c