From: Colin Ian King <colin.king@canonical.com>
Date: Wed, 22 Jul 2020 13:09:03 +0000 (+0200)
Subject: media: allegro: fix potential null dereference on header
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=04320b3ef90bef04df6672e3a98a266b88c35b55;p=linux.git

media: allegro: fix potential null dereference on header

The pointer header is an alias to msg and msg is being null checked.
However, if msg is null then header is also null and this can lead to
a null pointer dereference on the assignment type = header->type. Fix
this just using header->type after the null check and removing the need
for type as it is only used once.

Addresses-Coverity: ("Dereference before null check")

Fixes: 3de16839669f ("media: allegro: add explicit mail encoding and decoding")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
---

diff --git a/drivers/staging/media/allegro-dvt/allegro-mail.c b/drivers/staging/media/allegro-dvt/allegro-mail.c
index 4ac65de124639..9286d21623772 100644
--- a/drivers/staging/media/allegro-dvt/allegro-mail.c
+++ b/drivers/staging/media/allegro-dvt/allegro-mail.c
@@ -462,13 +462,12 @@ allegro_dec_encode_frame(struct mcu_msg_encode_frame_response *msg, u32 *src)
 ssize_t allegro_encode_mail(u32 *dst, void *msg)
 {
 	const struct mcu_msg_header *header = msg;
-	enum mcu_msg_type type = header->type;
 	ssize_t size;
 
 	if (!msg || !dst)
 		return -EINVAL;
 
-	switch (type) {
+	switch (header->type) {
 	case MCU_MSG_TYPE_INIT:
 		size = allegro_enc_init(&dst[1], msg);
 		break;