mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-11 04:18:39 +08:00
96d8569563
The maximum number of buffers that can be requested was increased to
64 for the video capture queue. But video capture used a must_blank
array that was still sized for 32 (VIDEO_MAX_FRAME). This caused an
out-of-bounds write when using buffer indices >= 32.
Create a new define MAX_VID_CAP_BUFFERS that is used to access the
must_blank array and set max_num_buffers for the video capture queue.
This solves a crash reported by:
https://bugzilla.kernel.org/show_bug.cgi?id=219258
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| vivid-cec.c | ||
| vivid-cec.h | ||
| vivid-core.c | ||
| vivid-core.h | ||
| vivid-ctrls.c | ||
| vivid-ctrls.h | ||
| vivid-kthread-cap.c | ||
| vivid-kthread-cap.h | ||
| vivid-kthread-out.c | ||
| vivid-kthread-out.h | ||
| vivid-kthread-touch.c | ||
| vivid-kthread-touch.h | ||
| vivid-meta-cap.c | ||
| vivid-meta-cap.h | ||
| vivid-meta-out.c | ||
| vivid-meta-out.h | ||
| vivid-osd.c | ||
| vivid-osd.h | ||
| vivid-radio-common.c | ||
| vivid-radio-common.h | ||
| vivid-radio-rx.c | ||
| vivid-radio-rx.h | ||
| vivid-radio-tx.c | ||
| vivid-radio-tx.h | ||
| vivid-rds-gen.c | ||
| vivid-rds-gen.h | ||
| vivid-sdr-cap.c | ||
| vivid-sdr-cap.h | ||
| vivid-touch-cap.c | ||
| vivid-touch-cap.h | ||
| vivid-vbi-cap.c | ||
| vivid-vbi-cap.h | ||
| vivid-vbi-gen.c | ||
| vivid-vbi-gen.h | ||
| vivid-vbi-out.c | ||
| vivid-vbi-out.h | ||
| vivid-vid-cap.c | ||
| vivid-vid-cap.h | ||
| vivid-vid-common.c | ||
| vivid-vid-common.h | ||
| vivid-vid-out.c | ||
| vivid-vid-out.h | ||