media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup

Browse source

[ Upstream commit 8fbcf730cb ]

variable *nplanes is provided by user via system call argument. The
possible value of q_data->fmt->num_planes is 1-3, while the value
of *nplanes can be 1-8. The array access by index i can cause array
out-of-bounds.

Fix this bug by checking *nplanes against the array size.

Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Wei Chen 2023-03-29 09:05:13 +01:00 • committed by Greg Kroah-Hartman

parent 83c42283bf

commit 48e4e06e2c

1 changed files with 7 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c

View file