Selaa lähdekoodia

video: driver: fix invalid ptr dereference issue with struct v4l2_buffer

qbuf call for actual bitstream and yuv buffer 'struct v4l2_buffer'
length field indicates numplanes and for metadata buffers, length field
indicates capacity. So always check length field before accessing/
dereferencing b->m.planes or b->m.fd.

Change-Id: I409b28e0a66bd5c031b2c98c6d7614da99164a6c
Signed-off-by: Govindaraj Rajagopal <[email protected]>
Govindaraj Rajagopal 3 vuotta sitten
vanhempi
sitoutus
58a111c212
1 muutettua tiedostoa jossa 7 lisäystä ja 2 poistoa
  1. 7 2
      driver/vidc/src/msm_vidc.c

+ 7 - 2
driver/vidc/src/msm_vidc.c

@@ -28,10 +28,15 @@
 
 #define MAX_EVENTS 30
 
-bool valid_v4l2_buffer(struct v4l2_buffer *b,
+static inline bool valid_v4l2_buffer(struct v4l2_buffer *b,
 		struct msm_vidc_inst *inst)
 {
-	return true;
+	if (b->type == INPUT_MPLANE || b->type == OUTPUT_MPLANE)
+		return b->length > 0;
+	else if (b->type == INPUT_META_PLANE || b->type == OUTPUT_META_PLANE)
+		return true;
+
+	return false;
 }
 
 static int get_poll_flags(struct msm_vidc_inst *inst, u32 port)