mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 16:37:50 +00:00
media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup
variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds. Fix this bug by checking *nplanes against the array size. Signed-off-by: Wei Chen <harperchen1110@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
This commit is contained in:
parent
e2a10b3801
commit
8fbcf730cb
1 changed files with 7 additions and 0 deletions
|
@ -735,6 +735,13 @@ int vb2ops_vdec_queue_setup(struct vb2_queue *vq, unsigned int *nbuffers,
|
|||
}
|
||||
|
||||
if (*nplanes) {
|
||||
if (vq->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
|
||||
if (*nplanes != q_data->fmt->num_planes)
|
||||
return -EINVAL;
|
||||
} else {
|
||||
if (*nplanes != 1)
|
||||
return -EINVAL;
|
||||
}
|
||||
for (i = 0; i < *nplanes; i++) {
|
||||
if (sizes[i] < q_data->sizeimage[i])
|
||||
return -EINVAL;
|
||||
|
|
Loading…
Reference in a new issue