提交 f0b7c7fc 编写于 作者: M Marek Szyprowski 提交者: Mauro Carvalho Chehab

[media] media: vb2: fix queueing of userptr buffers with null buffer pointer

Heuristic that checks if the memory pointer has been changed lacked a check
if the pointer was actually provided by the userspace, what allowed one to
queue a NULL pointer which was accepted without further checking. This
patch fixes this issue.
Reported-by: NSylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
CC: Pawel Osciak <pawel@osciak.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
上级 54828d19
...@@ -883,7 +883,8 @@ static int __qbuf_userptr(struct vb2_buffer *vb, const struct v4l2_buffer *b) ...@@ -883,7 +883,8 @@ static int __qbuf_userptr(struct vb2_buffer *vb, const struct v4l2_buffer *b)
for (plane = 0; plane < vb->num_planes; ++plane) { for (plane = 0; plane < vb->num_planes; ++plane) {
/* Skip the plane if already verified */ /* Skip the plane if already verified */
if (vb->v4l2_planes[plane].m.userptr == planes[plane].m.userptr if (vb->v4l2_planes[plane].m.userptr &&
vb->v4l2_planes[plane].m.userptr == planes[plane].m.userptr
&& vb->v4l2_planes[plane].length == planes[plane].length) && vb->v4l2_planes[plane].length == planes[plane].length)
continue; continue;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册