瀏覽代碼

[media] vivid: fix buffer overrun

The random_line buffer must be twice the maximum width, but it only allocated
the maximum width, so it was only half the size it needed to be.

Surprisingly I never saw the kernel fail on this, but the same TPG code used in
qv4l2 crashed and valgrind helped me track this bug down.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Hans Verkuil 11 年之前
父節點
當前提交
c204e1fafb
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      drivers/media/platform/vivid/vivid-tpg.c

+ 1 - 1
drivers/media/platform/vivid/vivid-tpg.c

@@ -136,7 +136,7 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
 		tpg->black_line[plane] = vzalloc(max_w * pixelsz);
 		if (!tpg->black_line[plane])
 			return -ENOMEM;
-		tpg->random_line[plane] = vzalloc(max_w * pixelsz);
+		tpg->random_line[plane] = vzalloc(max_w * 2 * pixelsz);
 		if (!tpg->random_line[plane])
 			return -ENOMEM;
 	}