mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 13:22:57 +00:00
media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
commite7f2e65699
upstream. variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds. Fix this bug by checking *nplanes against the array size. Fixes:4e855a6efa
("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver") Signed-off-by: Wei Chen <harperchen1110@gmail.com> Cc: stable@vger.kernel.org Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
4919043ab9
commit
fe04122b93
1 changed files with 2 additions and 0 deletions
|
@ -821,6 +821,8 @@ static int vb2ops_venc_queue_setup(struct vb2_queue *vq,
|
|||
return -EINVAL;
|
||||
|
||||
if (*nplanes) {
|
||||
if (*nplanes != q_data->fmt->num_planes)
|
||||
return -EINVAL;
|
||||
for (i = 0; i < *nplanes; i++)
|
||||
if (sizes[i] < q_data->sizeimage[i])
|
||||
return -EINVAL;
|
||||
|
|
Loading…
Reference in a new issue