vivid: fix buffer overrun

PATCH New Hans Verkuil 1 participant 1 message Oct 7, 2014 Media (V4L/DVB)

Share & tools

Hans Verkuil

author

2014-10-07 11:59 UTC #0 lore raw

PATCH 1/1 vivid: fix buffer overrun

The random_line buffer must be twice the maximum width, but it only allocated the maximum width, so it was only half the size it needed to be.

Surprisingly I never saw the kernel fail on this, but the same TPG code used in qv4l2 crashed and valgrind helped me track this bug down.

Signed-off-by Hans Verkuil <[email protected]>

drivers/media/platform/vivid/vivid-tpg.c +1 -1

index 0c6fa53..cbcd625 100644
@@ -136,7 +136,7 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
 		tpg->black_line[plane] = vzalloc(max_w * pixelsz);
 		if (!tpg->black_line[plane])
 			return -ENOMEM;
-		tpg->random_line[plane] = vzalloc(max_w * pixelsz);
+		tpg->random_line[plane] = vzalloc(max_w * 2 * pixelsz);
 		if (!tpg->random_line[plane])
 			return -ENOMEM;
 	}