From: Philipp Zabel Date: Thu, 9 Jul 2015 10:10:13 +0000 (-0300) Subject: [media] coda: fix mvcol buffer for MPEG4 decoding X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b05959c66e865fb9eb5b93e223da925572130d7f;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git [media] coda: fix mvcol buffer for MPEG4 decoding The mvcol buffer is allocated at the end of the first internal buffer. This patch fixes an out of bounds array access. Signed-off-by: Philipp Zabel Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c index 9fbff248d7fa..47fc2f19a4a9 100644 --- a/drivers/media/platform/coda/coda-bit.c +++ b/drivers/media/platform/coda/coda-bit.c @@ -384,7 +384,7 @@ static int coda_alloc_framebuffers(struct coda_ctx *ctx, /* mvcol buffer for mpeg4 */ if ((dev->devtype->product != CODA_DX6) && (ctx->codec->src_fourcc == V4L2_PIX_FMT_MPEG4)) - coda_parabuf_write(ctx, 97, ctx->internal_frames[i].paddr + + coda_parabuf_write(ctx, 97, ctx->internal_frames[0].paddr + ysize + ysize/4 + ysize/4); return 0;