Commit 74799372 authored by Dafna Hirschfeld's avatar Dafna Hirschfeld Committed by Mauro Carvalho Chehab
Browse files

media: vicodec: Handle the case that the reference buffer is NULL 



In the stateless decoder the reference buffer is null if the
frame is an I-frame (flagged with FWHT_FL_I_FRAME).
Make sure not to dereference it in that case.

Signed-off-by: default avatarDafna Hirschfeld <dafna3@gmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
parent 50e4c5e1

drivers/media/platform/vicodec/codec-fwht.c

+5 −4
Original line number Diff line number Diff line
@@ -841,6 +841,7 @@ static bool decode_plane(struct fwht_cframe *cf, const __be16 **rlco, 
	s16 copy[8 * 8];

	u16 stat;

	unsigned int i, j;

	bool is_intra = !ref;



	width = round_up(width, 8);

	height = round_up(height, 8);
@@ -872,7 +873,7 @@ static bool decode_plane(struct fwht_cframe *cf, const __be16 **rlco, 


			if (copies) {

				memcpy(cf->de_fwht, copy, sizeof(copy));

				if (stat & PFRAME_BIT)

				if ((stat & PFRAME_BIT) && !is_intra)

					add_deltas(cf->de_fwht, refp,

						   ref_stride, ref_step);

				fill_decoder_block(dstp, cf->de_fwht,
@@ -884,18 +885,18 @@ static bool decode_plane(struct fwht_cframe *cf, const __be16 **rlco, 
			stat = derlc(rlco, cf->coeffs, end_of_rlco_buf);

			if (stat & OVERFLOW_BIT)

				return false;

			if (stat & PFRAME_BIT)

			if ((stat & PFRAME_BIT) && !is_intra)

				dequantize_inter(cf->coeffs);

			else

				dequantize_intra(cf->coeffs);



			ifwht(cf->coeffs, cf->de_fwht,

			      (stat & PFRAME_BIT) ? 0 : 1);

			      ((stat & PFRAME_BIT) && !is_intra) ? 0 : 1);



			copies = (stat & DUPS_MASK) >> 1;

			if (copies)

				memcpy(copy, cf->de_fwht, sizeof(copy));

			if (stat & PFRAME_BIT)

			if ((stat & PFRAME_BIT) && !is_intra)

				add_deltas(cf->de_fwht, refp,

					   ref_stride, ref_step);

			fill_decoder_block(dstp, cf->de_fwht, dst_stride,

drivers/media/platform/vicodec/codec-v4l2-fwht.c

+11 −0
Original line number Diff line number Diff line
@@ -99,6 +99,17 @@ static int prepare_raw_frame(struct fwht_raw_frame *rf, 
	rf->alpha = NULL;

	rf->components_num = info->components_num;



	/*

	 * The buffer is NULL if it is the reference

	 * frame of an I-frame in the stateless decoder

	 */

	if (!buf) {

		rf->luma = NULL;

		rf->cb = NULL;

		rf->cr = NULL;

		rf->alpha = NULL;

		return 0;

	}

	switch (info->id) {

	case V4L2_PIX_FMT_GREY:

		rf->cb = NULL;