Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a629f86b authored by Sylwester Nawrocki's avatar Sylwester Nawrocki Committed by Mauro Carvalho Chehab
Browse files

[media] s5p-fimc: Fix wrong buffer size in queue_setup 



Avoid dereferencing of NULL f->fmt. Correct size of the allocated
buffer in case the crop rectangle is smaller than the bounds
rectangle (configured with S_FMT). Also remove redundant check
for *num_buffer == 0 as this case is handled in videobuf2.

Signed-off-by: default avatarSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: default avatarKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 3495dcef

drivers/media/video/s5p-fimc/fimc-core.c

+4 −8
Original line number Diff line number Diff line
@@ -704,22 +704,18 @@ static int fimc_queue_setup(struct vb2_queue *vq, unsigned int *num_buffers, 
	f = ctx_get_frame(ctx, vq->type);

	if (IS_ERR(f))

		return PTR_ERR(f);



	/*

	 * Return number of non-contigous planes (plane buffers)

	 * depending on the configured color format.

	 */

	if (f->fmt)

		*num_planes = f->fmt->memplanes;

	if (!f->fmt)

		return -EINVAL;



	*num_planes = f->fmt->memplanes;

	for (i = 0; i < f->fmt->memplanes; i++) {

		sizes[i] = (f->width * f->height * f->fmt->depth[i]) >> 3;

		sizes[i] = (f->f_width * f->f_height * f->fmt->depth[i]) / 8;

		allocators[i] = ctx->fimc_dev->alloc_ctx;

	}



	if (*num_buffers == 0)

		*num_buffers = 1;



	return 0;

}