Merge tag 'media/v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media fixes from Mauro Carvalho Chehab:
 "Core:
   - add bounded tile-count helpers for HEVC stateless decoders
   - validate AV1 tile counts fits in array size
   - validate HEVC tile counts fits in array size
   - fix memcmp() size in B1 reference list comparison

  mediatek:
   - bound AV1 tile-start copy to fit in array size

  rockchip:
   - reject AV1 frames exceeding the tile size
   - guard VPU981 AV1 divisor and tile buffer

  hantro and rkvdec:
    - bound G2 HEVC tile loops and PPS id to the buffer size

  rppx1:
   - read the raw pattern from the PRE2 acquisition module
   - describe the MAIN_POST white balance gains block"

* tag 'media/v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
  media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
  media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
  media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
  media: rkvdec: bound HEVC tile loops and PPS id to the array capacity
  media: hevc: add bounded tile-count helpers
  media: v4l2-ctrls: validate AV1 tile counts
  media: v4l2-ctrls: validate HEVC tile counts
  media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
  media: rppx1: bls: read the raw pattern from the PRE2 acquisition module
  media: rppx1: describe the MAIN_POST white balance gains block

1 files changed, 41 insertions, 0 deletions

diff --git a/include/media/v4l2-hevc.h b/include/media/v4l2-hevc.h
new file mode 100644
index 000000000000..973c96be16be
--- /dev/null
+++ b/include/media/v4l2-hevc.h
@@ -0,0 +1,41 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Helper functions for HEVC stateless codecs.
+ */
+
+#ifndef _MEDIA_V4L2_HEVC_H
+#define _MEDIA_V4L2_HEVC_H
+
+#include <linux/minmax.h>
+#include <media/v4l2-ctrls.h>
+
+/**
+ * v4l2_hevc_pps_num_tile_columns - number of HEVC tile columns, bounded
+ * @pps: the V4L2 HEVC PPS control
+ *
+ * Return the number of tile columns (num_tile_columns_minus1 + 1) clamped to
+ * the capacity of column_width_minus1[]. The control validation already
+ * rejects out-of-range counts; this keeps the consuming drivers bounded too.
+ */
+static inline unsigned int
+v4l2_hevc_pps_num_tile_columns(const struct v4l2_ctrl_hevc_pps *pps)
+{
+	return min_t(unsigned int, pps->num_tile_columns_minus1 + 1,
+		     ARRAY_SIZE(pps->column_width_minus1));
+}
+
+/**
+ * v4l2_hevc_pps_num_tile_rows - number of HEVC tile rows, bounded
+ * @pps: the V4L2 HEVC PPS control
+ *
+ * Return the number of tile rows (num_tile_rows_minus1 + 1) clamped to the
+ * capacity of row_height_minus1[].
+ */
+static inline unsigned int
+v4l2_hevc_pps_num_tile_rows(const struct v4l2_ctrl_hevc_pps *pps)
+{
+	return min_t(unsigned int, pps->num_tile_rows_minus1 + 1,
+		     ARRAY_SIZE(pps->row_height_minus1));
+}
+
+#endif /* _MEDIA_V4L2_HEVC_H */