kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/media/platform
History
Wei Chen 48e4e06e2c media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup 
[ Upstream commit 8fbcf730cb ]

variable *nplanes is provided by user via system call argument. The
possible value of q_data->fmt->num_planes is 1-3, while the value
of *nplanes can be 1-8. The array access by index i can cause array
out-of-bounds.

Fix this bug by checking *nplanes against the array size.

Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-05-24 17:32:36 +01:00
..
allegro-dvt media: v4l: ioctl: Set bus_info in v4l_querycap() 2022-04-24 08:07:08 +01:00
amlogic media: platform: fix some double free in meson-ge2d and mtk-jpeg and s5p-mfc 2022-08-30 15:20:49 +02:00
amphion media: amphion: decoder implement display delay enable 2023-05-11 23:03:10 +09:00
aspeed media: aspeed: Fix an error handling path in aspeed_video_probe() 2022-05-13 09:13:17 +02:00
atmel media: Replace dependency on VIDEO_V4L2_SUBDEV_API with select 2022-07-15 15:19:48 +01:00
cadence media: cadence: cdns-csi2tx: Use mipi-csi2.h 2022-05-13 11:02:20 +02:00
chips-media media: coda: Add check for kmalloc 2022-12-31 13:32:25 +01:00
intel media: avoid use of 'videobuf' 2022-08-29 16:27:18 +02:00
marvell media: avoid use of 'videobuf' 2022-08-29 16:27:18 +02:00
mediatek media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup 2023-05-24 17:32:36 +01:00
nvidia media: tegra-vde: Use vb2_find_buffer 2022-07-17 11:12:21 +01:00
nxp media: imx-jpeg: Apply clk_bulk api instead of operating specific clk 2023-03-10 09:33:43 +01:00
qcom media: venus: dec: Fix capture formats enumeration order 2023-05-11 23:03:15 +09:00
renesas media: Prefer designated initializers over memset for subdev pad ops 2023-05-24 17:32:36 +01:00
rockchip media: drivers: use video device pipeline start/stop 2022-09-24 09:14:20 +02:00
samsung media: Prefer designated initializers over memset for subdev pad ops 2023-05-24 17:32:36 +01:00
st media: bdisp: Add missing check for create_workqueue 2023-05-11 23:03:10 +09:00
sunxi media: sun8i-a83t-mipi-csi2: Register async subdev with no sensor attached 2022-12-31 13:32:17 +01:00
ti media: Prefer designated initializers over memset for subdev pad ops 2023-05-24 17:32:36 +01:00
verisilicon media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399 2023-03-10 09:33:43 +01:00
via media: Kconfig: cleanup VIDEO_DEV dependencies 2022-03-18 05:58:35 +01:00
xilinx media: drivers: use video_device_pipeline() 2022-09-24 09:14:59 +02:00
Kconfig media: destage Hantro VPU driver 2022-08-31 10:23:50 +02:00
m2m-deinterlace.c media: media/platform: rename VFL_TYPE_GRABBER to _VIDEO 2020-02-24 16:54:14 +01:00
Makefile media: destage Hantro VPU driver 2022-08-31 10:23:50 +02:00
video-mux.c media: mc-entity: Rename media_entity_remote_pad() to media_pad_remote_pad_first() 2022-07-17 11:21:35 +01:00