Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2181cbe authored by Gautham Mayyuri's avatar Gautham Mayyuri
Browse files

msm: camera: jpegdma: Fix incorrect buffer struct size 



Use of incorrect buffer struct size is causing
memory out of bound access, fixed issue by using
the correct struct size.

Change-Id: I193e14ffe63bc28af18a4d00f551253118e28080
Signed-off-by: default avatarGautham Mayyuri <gmayyuri@codeaurora.org>
parent 2dc96b1c

drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_dev.c

+3 −3
Original line number Diff line number Diff line 
/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -496,7 +496,7 @@ static int msm_jpegdma_queue_init(void *priv, struct vb2_queue *src_vq, 
	src_vq->drv_priv = ctx;

	src_vq->mem_ops = &msm_jpegdma_vb2_mem_ops;

	src_vq->ops = &msm_jpegdma_vb2_q_ops;

	src_vq->buf_struct_size = sizeof(struct vb2_v4l2_buffer);

	src_vq->buf_struct_size = sizeof(struct v4l2_m2m_buffer);

	src_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;



	ret = vb2_queue_init(src_vq);
@@ -510,7 +510,7 @@ static int msm_jpegdma_queue_init(void *priv, struct vb2_queue *src_vq, 
	dst_vq->drv_priv = ctx;

	dst_vq->mem_ops = &msm_jpegdma_vb2_mem_ops;

	dst_vq->ops = &msm_jpegdma_vb2_q_ops;

	dst_vq->buf_struct_size = sizeof(struct vb2_v4l2_buffer);

	dst_vq->buf_struct_size = sizeof(struct v4l2_m2m_buffer);

	dst_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;



	ret = vb2_queue_init(dst_vq);