Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b59d33a2 authored by Gilad Broner's avatar Gilad Broner
Browse files

media: dvb: Fix section pipe handling 



Calculation of pending data size in the section pipe, and other polled
pipes as well, added 1 extra byte which is correct only for the first
calculation.
In addition lookup of the feed object did not make sure feed type
is indeed a section feed, which could lead to undefined behavior.

Change-Id: Ic1699161106ab2183f8e08b02b78d9fe28b582f3
Signed-off-by: default avatarGilad Broner <gbroner@codeaurora.org>
parent 08a831a6

drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_tspp_v2.c

+8 −6
Original line number Diff line number Diff line
@@ -652,12 +652,12 @@ static inline size_t mpq_dmx_tspp2_calc_pipe_data(struct pipe_info *pipe_info, 
	}



	if (prev_last_addr == 0)

		prev_last_addr = pipe_info->buffer.iova;



		data_size = last_addr - pipe_info->buffer.iova + 1;

	else

		data_size = last_addr > prev_last_addr ?

			last_addr - prev_last_addr :

			pipe_info->buffer.size + last_addr - prev_last_addr;

	data_size += 1;



	MPQ_DVB_DBG_PRINT(

		"%s: buf_size=%u, last_addr=0x%x, prev_last_addr=0x%x -> data size=%u\n",

		__func__, pipe_info->buffer.size, last_addr,
@@ -2685,7 +2685,9 @@ static int mpq_dmx_tspp2_section_pipe_handler(struct pipe_info *pipe_info, 
		curr_pid = ts_pid(curr_pkt);



		list_for_each_entry(feed, &dvb_demux->feed_list, list_head) {

			if (feed->pid != curr_pid)

			if (feed->pid != curr_pid ||

				feed->type != DMX_TYPE_SEC ||

				feed->state != DMX_STATE_GO)

				continue;



			ret = mpq_dmx_tspp2_process_clear_section_packet(feed,