media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
authorMing Qian <ming.qian@nxp.com>
Fri, 16 Dec 2022 08:30:33 +0000 (09:30 +0100)
committerMauro Carvalho Chehab <mchehab@kernel.org>
Wed, 8 Feb 2023 06:25:02 +0000 (07:25 +0100)
commit41959c4f973b837a12061b84d3a436fc64c73a30
tree0bc6c4d3ade25d807dc773a5cb5f62b5e5db8a0d
parente3f7feb6d89311f369dd4ad903ea62e45328cdbe
media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data

The curr pointer has advanced 14 bytes in jpeg_parse_app14_data.
1. jpeg_get_word_be(stream), it goes forward 2 bytes.
2. jpeg_skip(stream, 11), it goes forward 11 bytes.
3. jpeg_get_byte(stream), it goes forward 1 bytes.

so the remain bytes of this segment should be (lp - 2 - 11 - 1),
but not (lp - 2 - 11).

if driver skip 1 extra bytes, the following parsing may go wrong.

Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers")
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
drivers/media/v4l2-core/v4l2-jpeg.c