[media] coda: fix mvcol buffer for MPEG4 decoding
authorPhilipp Zabel <p.zabel@pengutronix.de>
Thu, 9 Jul 2015 10:10:13 +0000 (07:10 -0300)
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>
Fri, 17 Jul 2015 13:51:49 +0000 (10:51 -0300)
The mvcol buffer is allocated at the end of the first internal buffer.
This patch fixes an out of bounds array access.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/platform/coda/coda-bit.c

index 9fbff248d7fa214fdaca72749302658b7d504ef4..47fc2f19a4a9afda31e5dc830c962cc551d3009f 100644 (file)
@@ -384,7 +384,7 @@ static int coda_alloc_framebuffers(struct coda_ctx *ctx,
        /* mvcol buffer for mpeg4 */
        if ((dev->devtype->product != CODA_DX6) &&
            (ctx->codec->src_fourcc == V4L2_PIX_FMT_MPEG4))
-               coda_parabuf_write(ctx, 97, ctx->internal_frames[i].paddr +
+               coda_parabuf_write(ctx, 97, ctx->internal_frames[0].paddr +
                                            ysize + ysize/4 + ysize/4);
 
        return 0;