From: miaohong chen <miaohong.chen@amlogic.com>
Date: Thu, 17 Dec 2020 05:53:13 +0000 (+0800)
Subject: mpeg2: pip user data pushing crash [1/1]
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=e6b95fd8ea67c54d1226d4a2a40828f7d4ce12d4;p=GitHub%2FLineageOS%2FG12%2Fandroid_hardware_amlogic_kernel-modules_media.git

mpeg2: pip user data pushing crash [1/1]

PD#SWPL-39533

Problem:
wrong user data over size causes crash.

Solution:
limit user data pushing size

Verify:
AH212

Change-Id: I581429122d39803cbe1b00280575f94b7a71812c
Signed-off-by: miaohong chen <miaohong.chen@amlogic.com>
---

diff --git a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
index 1fb6209..5bf0a8a 100644
--- a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
+++ b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c
@@ -1372,9 +1372,9 @@ static void userdata_push_do_work(struct work_struct *work)
 	}
 
 	cur_wp = reg & 0x7fff;
-	if (cur_wp == hw->ucode_cc_last_wp) {
+	if (cur_wp == hw->ucode_cc_last_wp || (cur_wp >= AUX_BUF_ALIGN(CCBUF_SIZE))) {
 		debug_print(DECODE_ID(hw), 0,
-			"Null user data package: wp = %d\n", cur_wp);
+			"Null or Over size user data package: wp = %d\n", cur_wp);
 		WRITE_VREG(AV_SCRATCH_J, 0);
 		return;
 	}
@@ -1482,7 +1482,7 @@ static void userdata_push_do_work(struct work_struct *work)
 
 	hw->userdata_info.last_wp += data_length;
 	if (hw->userdata_info.last_wp >= USER_DATA_SIZE)
-		hw->userdata_info.last_wp -= USER_DATA_SIZE;
+		hw->userdata_info.last_wp %= USER_DATA_SIZE;
 
 	hw->wait_for_udr_send = 1;