FEX-Emu/linux
1
0
Fork 0
mirror of https://github.com/FEX-Emu/linux.git synced 2024-12-20 16:30:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[media] media: vb2: fix queueing of userptr buffers with null buffer pointer

Browse Source 
Heuristic that checks if the memory pointer has been changed lacked a check
if the pointer was actually provided by the userspace, what allowed one to
queue a NULL pointer which was accepted without further checking. This
patch fixes this issue.

Reported-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
CC: Pawel Osciak <pawel@osciak.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Marek Szyprowski 2011-11-16 15:09:40 -03:00 committed by Mauro Carvalho Chehab
parent 54828d19f8
commit f0b7c7fc6f
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/media/video/videobuf2-core.c
View File

@ -883,7 +883,8 @@ static int __qbuf_userptr(struct vb2_buffer *vb, const struct v4l2_buffer *b)
for (plane = 0; plane < vb->num_planes; ++plane) {
/* Skip the plane if already verified */
if (vb->v4l2_planes[plane].m.userptr == planes[plane].m.userptr
if (vb->v4l2_planes[plane].m.userptr &&
vb->v4l2_planes[plane].m.userptr == planes[plane].m.userptr
&& vb->v4l2_planes[plane].length == planes[plane].length)
continue;