linux

History

Yong Zhi 401f69308f media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init With "pages" initialized to vb length + 1 pages, the condition check if(!pages--) will break at one more page than intended, this can result in out-of-bound access to b->lop[i][j] when setting the last dummy page. Fixes: `c7cbef1fdb` ("media: intel-ipu3: cio2: fix a crash with out-of-bounds access") Signed-off-by: Yong Zhi <yong.zhi@intel.com> Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>	2018-01-23 08:08:44 -05:00
..
ipu3	media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init	2018-01-23 08:08:44 -05:00
Makefile

Yong Zhi 401f69308f media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init

With "pages" initialized to vb length + 1 pages, the condition
check if(!pages--) will break at one more page than intended,
this can result in out-of-bound access to b->lop[i][j] when setting
the last dummy page.

Fixes: c7cbef1fdb ("media: intel-ipu3: cio2: fix a crash with out-of-bounds access")

Signed-off-by: Yong Zhi <yong.zhi@intel.com>
Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

2018-01-23 08:08:44 -05:00

ipu3 media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init 2018-01-23 08:08:44 -05:00

Makefile