Skip to content
Commit e7f2e656 authored by Wei Chen's avatar Wei Chen Committed by Hans Verkuil
Browse files

media: vcodec: Fix potential array out-of-bounds in encoder queue_setup

variable *nplanes is provided by user via system call argument. The
possible value of q_data->fmt->num_planes is 1-3, while the value
of *nplanes can be 1-8. The array access by index i can cause array
out-of-bounds.

Fix this bug by checking *nplanes against the array size.

Fixes: 4e855a6e

 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
Signed-off-by: default avatarWei Chen <harperchen1110@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarChen-Yu Tsai <wenst@chromium.org>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
parent 2908042a
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment