diff options
| author | Zhaowei Yuan <zhaowei.yuan@samsung.com> | 2014-08-22 06:28:21 +0400 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2017-09-15 20:30:50 +0300 |
| commit | d52288ac550ea8635fab559defe48da4359ca9a3 (patch) | |
| tree | c4fce2609044d8f83bfa7a4eeb5649b281673a9b /drivers | |
| parent | c6b7065b8625bd1924e27bb4792560829b5cd603 (diff) | |
| download | linux-d52288ac550ea8635fab559defe48da4359ca9a3.tar.xz | |
vb2: fix plane index sanity check in vb2_plane_cookie()
commit a9ae4692eda4b99f85757b15d60971ff78a0a0e2 upstream.
It's also invalid when plane_no is equal to vb->num_planes
Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/video/videobuf2-core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c index 95a3f5e82aef..912a74f644a8 100644 --- a/drivers/media/video/videobuf2-core.c +++ b/drivers/media/video/videobuf2-core.c @@ -754,7 +754,7 @@ void *vb2_plane_cookie(struct vb2_buffer *vb, unsigned int plane_no) { struct vb2_queue *q = vb->vb2_queue; - if (plane_no > vb->num_planes) + if (plane_no >= vb->num_planes) return NULL; return call_memop(q, plane_no, cookie, vb->planes[plane_no].mem_priv); |