aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/media/platform/coda
diff options
context:
space:
mode:
authorPhilipp Zabel <p.zabel@pengutronix.de>2015-07-09 06:10:13 -0400
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>2015-07-17 09:51:49 -0400
commitb05959c66e865fb9eb5b93e223da925572130d7f (patch)
treecbe8d29c802b4f0afd2a4d47b0183a6c831205e6 /drivers/media/platform/coda
parentf964c409f7cc626335cf2370f55690660a273dad (diff)
[media] coda: fix mvcol buffer for MPEG4 decoding
The mvcol buffer is allocated at the end of the first internal buffer. This patch fixes an out of bounds array access. Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media/platform/coda')
-rw-r--r--drivers/media/platform/coda/coda-bit.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
index 9fbff248d7fa..47fc2f19a4a9 100644
--- a/drivers/media/platform/coda/coda-bit.c
+++ b/drivers/media/platform/coda/coda-bit.c
@@ -384,7 +384,7 @@ static int coda_alloc_framebuffers(struct coda_ctx *ctx,
384 /* mvcol buffer for mpeg4 */ 384 /* mvcol buffer for mpeg4 */
385 if ((dev->devtype->product != CODA_DX6) && 385 if ((dev->devtype->product != CODA_DX6) &&
386 (ctx->codec->src_fourcc == V4L2_PIX_FMT_MPEG4)) 386 (ctx->codec->src_fourcc == V4L2_PIX_FMT_MPEG4))
387 coda_parabuf_write(ctx, 97, ctx->internal_frames[i].paddr + 387 coda_parabuf_write(ctx, 97, ctx->internal_frames[0].paddr +
388 ysize + ysize/4 + ysize/4); 388 ysize + ysize/4 + ysize/4);
389 389
390 return 0; 390 return 0;