DF-3788 / harness_div0.c
/* * DF-3788 -- BT848_SCAPAREA with x_size=0 -> integer division by zero in * build_dma_prog() -> #DE -> kernel panic. * * Harness compiles the exact expression from bktr_core.c:3344-3346 with * format_params values for NTSC (format_params[1], bktr_core.c:191-192) and * runs it. Userspace SIGFPE == kernel integer-divide trap == panic. */ #include <stdio.h> #include <stdlib.h> /* format_params[] fields used (bktr_core.c:186-211): */ static const struct fp { int htotal, hdelay, hactive, scaled_hactive, scaled_htotal, vactive, vdelay; } FP_NTSC = { 910, 135, 754, 640, 780, 480, 26 }; int main(void) { int cols = 640, rows = 480; int capture_area_x_offset = 0, capture_area_y_offset = 0; int capture_area_x_size = 0, capture_area_y_size = 480; /* SCAPAREA w/ x_size=0 */ const struct fp *fp = &FP_NTSC; int temp; /* bktr_core.c:3320-3325 HSCALE (runs first, harmless with x_size=0) */ { long long t = ((long long)fp->htotal * (long long)capture_area_x_size * 4096 / fp->scaled_htotal / cols) - 4096; printf("HSCALE temp = %lld (fine)\n", t); } /* bktr_core.c:3344-3346: denominator = x_size * hactive = 0 * 754 */ printf("denominator = capture_area_x_size * hactive = %d * %d = %d\n", capture_area_x_size, fp->hactive, capture_area_x_size * fp->hactive); fflush(stdout); temp = ((fp->hdelay * fp->scaled_hactive + capture_area_x_offset * fp->scaled_htotal) * cols) / (capture_area_x_size * fp->hactive); /* <-- divide by zero */ printf("unreachable: temp=%d\n", temp); /* not reached */ return 0; } |