mpeg2: pip user data pushing crash [1/1]

PD#SWPL-39533

Problem:
wrong user data over size causes crash.

Solution:
limit user data pushing size

Verify:
AH212

Change-Id: I581429122d39803cbe1b00280575f94b7a71812c
Signed-off-by: miaohong chen <miaohong.chen@amlogic.com>

diff --git a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
index 1fb6209fa62844644e3e9709c4e1a19743eb725c..5bf0a8a5fe1c95e7b311c740fbc8dc055b3f32ff 100644 (file)
--- a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
+++ b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
@@ -1372,9 +1372,9 @@ static void userdata_push_do_work(struct work_struct *work)
        }
 
        cur_wp = reg & 0x7fff;
-       if (cur_wp == hw->ucode_cc_last_wp) {
+       if (cur_wp == hw->ucode_cc_last_wp || (cur_wp >= AUX_BUF_ALIGN(CCBUF_SIZE))) {
                debug_print(DECODE_ID(hw), 0,
-                       "Null user data package: wp = %d\n", cur_wp);
+                       "Null or Over size user data package: wp = %d\n", cur_wp);
                WRITE_VREG(AV_SCRATCH_J, 0);
                return;
        }
@@ -1482,7 +1482,7 @@ static void userdata_push_do_work(struct work_struct *work)
 
        hw->userdata_info.last_wp += data_length;
        if (hw->userdata_info.last_wp >= USER_DATA_SIZE)
-               hw->userdata_info.last_wp -= USER_DATA_SIZE;
+               hw->userdata_info.last_wp %= USER_DATA_SIZE;
 
        hw->wait_for_udr_send = 1;