Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c204e1fa authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

[media] vivid: fix buffer overrun 



The random_line buffer must be twice the maximum width, but it only allocated
the maximum width, so it was only half the size it needed to be.

Surprisingly I never saw the kernel fail on this, but the same TPG code used in
qv4l2 crashed and valgrind helped me track this bug down.

Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent a0bd3e0b

drivers/media/platform/vivid/vivid-tpg.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -136,7 +136,7 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w) 
		tpg->black_line[plane] = vzalloc(max_w * pixelsz);

		tpg->black_line[plane] = vzalloc(max_w * pixelsz);

		if (!tpg->black_line[plane])

		if (!tpg->black_line[plane])

			return -ENOMEM;

			return -ENOMEM;

		tpg->random_line[plane] = vzalloc(max_w * pixelsz);

		tpg->random_line[plane] = vzalloc(max_w * 2 * pixelsz);

		if (!tpg->random_line[plane])

		if (!tpg->random_line[plane])

			return -ENOMEM;

			return -ENOMEM;

	}

	}