Commit 25141bc7 authored by Philipp Zabel's avatar Philipp Zabel Committed by Mauro Carvalho Chehab
Browse files

media: coda: allocate space for mpeg4 decoder mvcol buffer 



The MPEG-4 decoder mvcol buffer was registered, but its size not added
to a frame buffer allocation. This could cause the decoder to write past
the end of the allocated buffer for large frame sizes.

Signed-off-by: default avatarPhilipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent 8e75a536

drivers/media/platform/coda/coda-bit.c

+4 −2
Original line number Diff line number Diff line
@@ -414,8 +414,10 @@ static int coda_alloc_framebuffers(struct coda_ctx *ctx, 
			size = round_up(ysize, 4096) + ysize / 2;

		else

			size = ysize + ysize / 2;

		if (ctx->codec->src_fourcc == V4L2_PIX_FMT_H264 &&

		    dev->devtype->product != CODA_DX6)

		/* Add space for mvcol buffers */

		if (dev->devtype->product != CODA_DX6 &&

		    (ctx->codec->src_fourcc == V4L2_PIX_FMT_H264 ||

		     (ctx->codec->src_fourcc == V4L2_PIX_FMT_MPEG4 && i == 0)))

			size += ysize / 4;

		name = kasprintf(GFP_KERNEL, "fb%d", i);

		if (!name) {