diff options
| author | Hans Verkuil <hverkuil@xs4all.nl> | 2014-10-07 08:58:55 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2014-10-21 08:52:11 -0200 |
| commit | c204e1fafbd50a158a34c8a5bd9682cb04ecb29b (patch) | |
| tree | 5a461b1684158d34930839266731efd7978c6502 /drivers/media | |
| parent | a0bd3e0b31500251876da505295834e73f33f6f8 (diff) | |
| download | op-kernel-dev-c204e1fafbd50a158a34c8a5bd9682cb04ecb29b.zip op-kernel-dev-c204e1fafbd50a158a34c8a5bd9682cb04ecb29b.tar.gz | |
[media] vivid: fix buffer overrun
The random_line buffer must be twice the maximum width, but it only allocated
the maximum width, so it was only half the size it needed to be.
Surprisingly I never saw the kernel fail on this, but the same TPG code used in
qv4l2 crashed and valgrind helped me track this bug down.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/platform/vivid/vivid-tpg.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/platform/vivid/vivid-tpg.c b/drivers/media/platform/vivid/vivid-tpg.c index 0c6fa53..cbcd625 100644 --- a/drivers/media/platform/vivid/vivid-tpg.c +++ b/drivers/media/platform/vivid/vivid-tpg.c @@ -136,7 +136,7 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w) tpg->black_line[plane] = vzalloc(max_w * pixelsz); if (!tpg->black_line[plane]) return -ENOMEM; - tpg->random_line[plane] = vzalloc(max_w * pixelsz); + tpg->random_line[plane] = vzalloc(max_w * 2 * pixelsz); if (!tpg->random_line[plane]) return -ENOMEM; } |
