Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 76ebc16b authored by Jean-François Moine's avatar Jean-François Moine Committed by Mauro Carvalho Chehab
Browse files

[media] gspca - main: Check the isoc packet status before its length 



When an error is set for an isochronous packet, the length of the packet
may be null. In this case, the error was not detected and the image
was not discarded as it should be.

Reported-by: default avatarFranck Bourdonnec <fbourdonnec@chez.com>
Signed-off-by: default avatarJean-François Moine <moinejf@free.fr>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent f2c5d92e

drivers/media/video/gspca/gspca.c

+6 −6
Original line number Diff line number Diff line
@@ -320,12 +320,6 @@ static void fill_frame(struct gspca_dev *gspca_dev, 
	for (i = 0; i < urb->number_of_packets; i++) {



		/* check the packet status and length */

		len = urb->iso_frame_desc[i].actual_length;

		if (len == 0) {

			if (gspca_dev->empty_packet == 0)

				gspca_dev->empty_packet = 1;

			continue;

		}

		st = urb->iso_frame_desc[i].status;

		if (st) {

			err("ISOC data error: [%d] len=%d, status=%d",
@@ -333,6 +327,12 @@ static void fill_frame(struct gspca_dev *gspca_dev, 
			gspca_dev->last_packet_type = DISCARD_PACKET;

			continue;

		}

		len = urb->iso_frame_desc[i].actual_length;

		if (len == 0) {

			if (gspca_dev->empty_packet == 0)

				gspca_dev->empty_packet = 1;

			continue;

		}



		/* let the packet be analyzed by the subdriver */

		PDEBUG(D_PACK, "packet [%d] o:%d l:%d",