diff options
| author |   Justin Green <greenjustin@chromium.org> | 2022-06-15 16:38:27 +0100 |
|---|---|---|
| committer |   Mauro Carvalho Chehab <mchehab@kernel.org> | 2022-06-27 09:11:12 +0100 |
| commit | f5caaa47f55fa742f1a230e5b4258c139e223c74 (patch) | |
| tree | c23382fdeb28e50eb31b23a0a82078cfa10216d9 | |
| parent | media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set (diff) | |
media: mediatek: vcodec: return EINVAL if plane is too small
Modify vb2ops_vdec_buf_prepare to return EINVAL if the size of the plane
is less than the size of the image. Currently we just log an error and
return 0 anyway, which may cause a buffer overrun bug.
Signed-off-by: Justin Green <greenjustin@chromium.org>
Suggested-by: Andres Calderon Jaramillo <andrescj@chromium.org>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
| -rw-r--r-- | drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c index 813dafd1b238..c96c95a740c8 100644 --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c @@ -797,6 +797,7 @@ int vb2ops_vdec_buf_prepare(struct vb2_buffer *vb) mtk_v4l2_err("data will not fit into plane %d (%lu < %d)", i, vb2_plane_size(vb, i), q_data->sizeimage[i]); + return -EINVAL; } if (!V4L2_TYPE_IS_OUTPUT(vb->type)) vb2_set_plane_payload(vb, i, q_data->sizeimage[i]); |