diff options
| author | Philipp Zabel | 2015-07-09 12:10:13 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab | 2015-07-17 15:51:49 +0200 |
| commit | b05959c66e865fb9eb5b93e223da925572130d7f (patch) | |
| tree | cbe8d29c802b4f0afd2a4d47b0183a6c831205e6 /drivers/media/platform | |
| parent | [media] coda: clamp frame sequence counters to 16 bit (diff) | |
| download | kernel-qcow2-linux-b05959c66e865fb9eb5b93e223da925572130d7f.tar.gz kernel-qcow2-linux-b05959c66e865fb9eb5b93e223da925572130d7f.tar.xz kernel-qcow2-linux-b05959c66e865fb9eb5b93e223da925572130d7f.zip | |
[media] coda: fix mvcol buffer for MPEG4 decoding
The mvcol buffer is allocated at the end of the first internal buffer.
This patch fixes an out of bounds array access.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media/platform')
| -rw-r--r-- | drivers/media/platform/coda/coda-bit.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c index 9fbff248d7fa..47fc2f19a4a9 100644 --- a/drivers/media/platform/coda/coda-bit.c +++ b/drivers/media/platform/coda/coda-bit.c @@ -384,7 +384,7 @@ static int coda_alloc_framebuffers(struct coda_ctx *ctx, /* mvcol buffer for mpeg4 */ if ((dev->devtype->product != CODA_DX6) && (ctx->codec->src_fourcc == V4L2_PIX_FMT_MPEG4)) - coda_parabuf_write(ctx, 97, ctx->internal_frames[i].paddr + + coda_parabuf_write(ctx, 97, ctx->internal_frames[0].paddr + ysize + ysize/4 + ysize/4); return 0; |