From fb0d4170c79932a979628320f606662daf1c6bb3 Mon Sep 17 00:00:00 2001 From: Praveen Chavan <pchavan@codeaurora.org> Date: Fri, 22 Jan 2016 12:59:31 -0800 Subject: [PATCH] msm: vidc: Make buffer validity checks stronger Check for the exact number of planes that we advertised to the client rather than the worst-case checks. Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org> Bug: 26425736 Change-Id: Ibaf705367db98beb0e01bb2c3087126cf2ba73e8 Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org> Signed-off-by: Praveen Chavan <pchavan@codeaurora.org> --- drivers/media/platform/msm/vidc/msm_vidc.c | 39 +++++++++------------- 1 file changed, 15 insertions(+), 24 deletions(-) diff --git a/drivers/media/platform/msm/vidc/msm_vidc.c b/drivers/media/platform/msm/vidc/msm_vidc.c index 77b29cc18c91..414e56473410 100644 --- a/drivers/media/platform/msm/vidc/msm_vidc.c +++ b/drivers/media/platform/msm/vidc/msm_vidc.c @@ -694,20 +694,25 @@ int output_buffer_cache_invalidate(struct msm_vidc_inst *inst, return 0; } +static bool valid_v4l2_buffer(struct v4l2_buffer *b, + struct msm_vidc_inst *inst) { + enum vidc_ports port = + !V4L2_TYPE_IS_MULTIPLANAR(b->type) ? MAX_PORT_NUM : + b->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE ? CAPTURE_PORT : + b->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE ? OUTPUT_PORT : + MAX_PORT_NUM; + + return port != MAX_PORT_NUM && + inst->fmts[port]->num_planes == b->length; +} + int msm_vidc_prepare_buf(void *instance, struct v4l2_buffer *b) { struct msm_vidc_inst *inst = instance; - if (!inst || !b) + if (!inst || !b || !valid_v4l2_buffer(b, inst)) return -EINVAL; - if (!V4L2_TYPE_IS_MULTIPLANAR(b->type) || !b->length || - (b->length > VIDEO_MAX_PLANES)) { - dprintk(VIDC_ERR, "%s: wrong input params\n", - __func__); - return -EINVAL; - } - if (is_dynamic_output_buffer_mode(b, inst)) { dprintk(VIDC_ERR, "%s: not supported in dynamic buffer mode\n", __func__); @@ -847,16 +852,9 @@ int msm_vidc_qbuf(void *instance, struct v4l2_buffer *b) int rc = 0; int i; - if (!inst || !b) + if (!inst || !b || !valid_v4l2_buffer(b, inst)) return -EINVAL; - if (!V4L2_TYPE_IS_MULTIPLANAR(b->type) || !b->length || - (b->length > VIDEO_MAX_PLANES)) { - dprintk(VIDC_ERR, "%s: wrong input params\n", - __func__); - return -EINVAL; - } - if (is_dynamic_output_buffer_mode(b, inst)) { if (b->m.planes[0].reserved[0]) inst->map_output_buffer = true; @@ -921,15 +919,8 @@ int msm_vidc_dqbuf(void *instance, struct v4l2_buffer *b) struct buffer_info *buffer_info = NULL; int i = 0, rc = 0; - if (!inst || !b) - return -EINVAL; - - if (!V4L2_TYPE_IS_MULTIPLANAR(b->type) || !b->length || - (b->length > VIDEO_MAX_PLANES)) { - dprintk(VIDC_ERR, "%s: wrong input params\n", - __func__); + if (!inst || !b || !valid_v4l2_buffer(b, inst)) return -EINVAL; - } if (inst->session_type == MSM_VIDC_DECODER) rc = msm_vdec_dqbuf(instance, b); -- GitLab