diff options
| author | Hans Verkuil <[email protected]> | 2024-10-24 08:21:30 +0000 |
|---|---|---|
| committer | Hans Verkuil <[email protected]> | 2024-10-28 08:14:12 +0000 |
| commit | 96d8569563916fe2f8fe17317e20e43f54f9ba4b (patch) | |
| tree | 4fc3a8a587fd5b60cbd84692160341f9293ad03a /drivers/usb/cdns3/cdns3-pci-wrap.c | |
| parent | media: pulse8-cec: fix data timestamp at pulse8_setup() (diff) | |
| download | kernel-96d8569563916fe2f8fe17317e20e43f54f9ba4b.tar.gz kernel-96d8569563916fe2f8fe17317e20e43f54f9ba4b.zip | |
media: vivid: fix buffer overwrite when using > 32 buffers
The maximum number of buffers that can be requested was increased to
64 for the video capture queue. But video capture used a must_blank
array that was still sized for 32 (VIDEO_MAX_FRAME). This caused an
out-of-bounds write when using buffer indices >= 32.
Create a new define MAX_VID_CAP_BUFFERS that is used to access the
must_blank array and set max_num_buffers for the video capture queue.
This solves a crash reported by:
https://bugzilla.kernel.org/show_bug.cgi?id=219258
Signed-off-by: Hans Verkuil <[email protected]>
Fixes: cea70ed416b4 ("media: test-drivers: vivid: Increase max supported buffers for capture queues")
Cc: [email protected]
Diffstat (limited to 'drivers/usb/cdns3/cdns3-pci-wrap.c')
0 files changed, 0 insertions, 0 deletions