[PATCH v2 20/37] baseband/acc100: check turbo dec/enc input

[Maxime Coquelin]

On 8/20/22 04:31, Hernan Vargas wrote:
> Add NULL check for the turbo decoder and encoder input length.
> 

Looks like a fix, please add Fixes tag and cc stable.

> Signed-off-by: Hernan Vargas <hernan.vargas at intel.com>
> ---
>   drivers/baseband/acc100/rte_acc100_pmd.c | 23 ++++++++++++++++++-----
>   1 file changed, 18 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/baseband/acc100/rte_acc100_pmd.c b/drivers/baseband/acc100/rte_acc100_pmd.c
> index deb2cb6d36..70a29f92a1 100644
> --- a/drivers/baseband/acc100/rte_acc100_pmd.c
> +++ b/drivers/baseband/acc100/rte_acc100_pmd.c
> @@ -2398,6 +2398,11 @@ validate_enc_op(struct rte_bbdev_enc_op *op, struct acc100_queue *q)
>   		return -1;
>   	}
>   
> +	if (turbo_enc->input.length == 0) {
> +		rte_bbdev_log(ERR, "input length null");
> +		return -1;
> +	}
> +
>   	if (turbo_enc->code_block_mode == RTE_BBDEV_TRANSPORT_BLOCK) {
>   		tb = &turbo_enc->tb_params;
>   		if ((tb->k_neg < RTE_BBDEV_TURBO_MIN_CB_SIZE
> @@ -2417,11 +2422,12 @@ validate_enc_op(struct rte_bbdev_enc_op *op, struct acc100_queue *q)
>   					RTE_BBDEV_TURBO_MAX_CB_SIZE);
>   			return -1;
>   		}
> -		if (tb->c_neg > (RTE_BBDEV_TURBO_MAX_CODE_BLOCKS - 1))
> +		if (tb->c_neg > 0) {
>   			rte_bbdev_log(ERR,
> -					"c_neg (%u) is out of range 0 <= value <= %u",
> -					tb->c_neg,
> -					RTE_BBDEV_TURBO_MAX_CODE_BLOCKS - 1);
> +					"c_neg (%u) expected to be null",
> +					tb->c_neg);
> +			return -1;
> +		}
>   		if (tb->c < 1 || tb->c > RTE_BBDEV_TURBO_MAX_CODE_BLOCKS) {
>   			rte_bbdev_log(ERR,
>   					"c (%u) is out of range 1 <= value <= %u",
> @@ -3320,6 +3326,11 @@ validate_dec_op(struct rte_bbdev_dec_op *op, struct acc100_queue *q)
>   		return -1;
>   	}
>   
> +	if (turbo_dec->input.length == 0) {
> +		rte_bbdev_log(ERR, "input length null");
> +		return -1;
> +	}
> +
>   	if (turbo_dec->code_block_mode == RTE_BBDEV_TRANSPORT_BLOCK) {
>   		tb = &turbo_dec->tb_params;
>   		if ((tb->k_neg < RTE_BBDEV_TURBO_MIN_CB_SIZE
> @@ -3340,11 +3351,13 @@ validate_dec_op(struct rte_bbdev_dec_op *op, struct acc100_queue *q)
>   					RTE_BBDEV_TURBO_MAX_CB_SIZE);
>   			return -1;
>   		}
> -		if (tb->c_neg > (RTE_BBDEV_TURBO_MAX_CODE_BLOCKS - 1))
> +		if (tb->c_neg > (RTE_BBDEV_TURBO_MAX_CODE_BLOCKS - 1)) {
>   			rte_bbdev_log(ERR,
>   					"c_neg (%u) is out of range 0 <= value <= %u",
>   					tb->c_neg,
>   					RTE_BBDEV_TURBO_MAX_CODE_BLOCKS - 1);
> +					return -1;
> +		}
>   		if (tb->c < 1 || tb->c > RTE_BBDEV_TURBO_MAX_CODE_BLOCKS) {
>   			rte_bbdev_log(ERR,
>   					"c (%u) is out of range 1 <= value <= %u",

With Fixes tag:
Reviewed-by: Maxime Coquelin <maxime.coquelin at redhat.com>

Thanks,
Maxime