diff options
| author | Michael Jones <michael.jones@matrix-vision.de> | 2011-08-09 08:42:20 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2011-09-11 09:49:27 -0300 |
| commit | 61e6561fae573c3c618118a71ff966ddb14299da (patch) | |
| tree | 2f79eb2b8daab4d025f45f216ac70028f5cdb79b | |
| parent | 00542edf071e249ccb541ffb2d2b9034e2533968 (diff) | |
| download | op-kernel-dev-61e6561fae573c3c618118a71ff966ddb14299da.zip op-kernel-dev-61e6561fae573c3c618118a71ff966ddb14299da.tar.gz | |
[media] omap3isp: queue: fail QBUF if user buffer is too small
Add buffer length check to sanity checks for USERPTR QBUF.
Signed-off-by: Michael Jones <michael.jones@matrix-vision.de>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| -rw-r--r-- | drivers/media/video/omap3isp/ispqueue.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/media/video/omap3isp/ispqueue.c b/drivers/media/video/omap3isp/ispqueue.c index 9c31714..9bebb1e 100644 --- a/drivers/media/video/omap3isp/ispqueue.c +++ b/drivers/media/video/omap3isp/ispqueue.c @@ -868,6 +868,10 @@ int omap3isp_video_queue_qbuf(struct isp_video_queue *queue, goto done; if (vbuf->memory == V4L2_MEMORY_USERPTR && + vbuf->length < buf->vbuf.length) + goto done; + + if (vbuf->memory == V4L2_MEMORY_USERPTR && vbuf->m.userptr != buf->vbuf.m.userptr) { isp_video_buffer_cleanup(buf); buf->vbuf.m.userptr = vbuf->m.userptr; |
