From e6b95fd8ea67c54d1226d4a2a40828f7d4ce12d4 Mon Sep 17 00:00:00 2001 From: miaohong chen Date: Thu, 17 Dec 2020 13:53:13 +0800 Subject: [PATCH] mpeg2: pip user data pushing crash [1/1] PD#SWPL-39533 Problem: wrong user data over size causes crash. Solution: limit user data pushing size Verify: AH212 Change-Id: I581429122d39803cbe1b00280575f94b7a71812c Signed-off-by: miaohong chen --- drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c index 1fb6209..5bf0a8a 100644 --- a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c +++ b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c @@ -1372,9 +1372,9 @@ static void userdata_push_do_work(struct work_struct *work) } cur_wp = reg & 0x7fff; - if (cur_wp == hw->ucode_cc_last_wp) { + if (cur_wp == hw->ucode_cc_last_wp || (cur_wp >= AUX_BUF_ALIGN(CCBUF_SIZE))) { debug_print(DECODE_ID(hw), 0, - "Null user data package: wp = %d\n", cur_wp); + "Null or Over size user data package: wp = %d\n", cur_wp); WRITE_VREG(AV_SCRATCH_J, 0); return; } @@ -1482,7 +1482,7 @@ static void userdata_push_do_work(struct work_struct *work) hw->userdata_info.last_wp += data_length; if (hw->userdata_info.last_wp >= USER_DATA_SIZE) - hw->userdata_info.last_wp -= USER_DATA_SIZE; + hw->userdata_info.last_wp %= USER_DATA_SIZE; hw->wait_for_udr_send = 1; -- 2.20.1