Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit ed1da130a6ebe7e7c8485668758ca3f96c413672

Authored by Nikhil Devshatwar
Committed by Jacob Stiffler
1 parent 13bc683e42
Exists in smarc-ti-linux-3.14.y and in 1 other branch processor-sdk-linux-01.00.00

media: vb2: verify data_offset only if nonzero bytesused 

verify_planes would fail if the user space fills up the data_offset field
and bytesused is left as zero. Correct this.
When comparing data_offset > bytesused, bypass the check if the
bytesused field is set to zero.

Change-Id: I4c63bc03f6d455ce00a56d63df08c624579bc831
Signed-off-by: Nikhil Devshatwar <nikhil.nd@ti.com>

Showing 1 changed file with 3 additions and 6 deletions Side-by-side Diff

drivers/media/v4l2-core/videobuf2-core.c
Diff comments   View file @ ed1da13
... ... @@ -394,12 +394,9 @@
394 394 ? b->m.planes[plane].length
395 395 : vb->v4l2_planes[plane].length;
396 396  
397   - if (b->m.planes[plane].bytesused > length)
398   - return -EINVAL;
399   -
400   - if (b->m.planes[plane].data_offset > 0 &&
401   - b->m.planes[plane].data_offset >=
402   - b->m.planes[plane].bytesused)
  397 + if (b->m.planes[plane].bytesused > 0 &&
  398 + b->m.planes[plane].data_offset +
  399 + b->m.planes[plane].bytesused > length)
403 400 return -EINVAL;
404 401 }
405 402 } else {