From: Sakari Ailus Date: Mon, 5 Oct 2015 15:45:29 +0000 (-0300) Subject: [media] media: Check for active and has_no_links overrun X-Git-Tag: v4.15-rc1~91^2~226 X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=885ca801e36d77c2d0025486b178c585a4680a80;p=uclinux-h8%2Flinux.git [media] media: Check for active and has_no_links overrun The active and has_no_links arrays will overrun in media_entity_pipeline_start() if there's an entity which has more than MEDIA_ENTITY_MAX_PAD pads. Ensure in media_entity_init() that there are fewer pads than that. Signed-off-by: Sakari Ailus Acked-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c index 2ace0410d277..f7c6d64e6031 100644 --- a/drivers/media/media-entity.c +++ b/drivers/media/media-entity.c @@ -214,12 +214,20 @@ void media_gobj_destroy(struct media_gobj *gobj) gobj->mdev = NULL; } +/* + * TODO: Get rid of this. + */ +#define MEDIA_ENTITY_MAX_PADS 512 + int media_entity_pads_init(struct media_entity *entity, u16 num_pads, struct media_pad *pads) { struct media_device *mdev = entity->graph_obj.mdev; unsigned int i; + if (num_pads >= MEDIA_ENTITY_MAX_PADS) + return -E2BIG; + entity->num_pads = num_pads; entity->pads = pads; @@ -280,11 +288,6 @@ static struct media_entity *stack_pop(struct media_graph *graph) #define link_top(en) ((en)->stack[(en)->top].link) #define stack_top(en) ((en)->stack[(en)->top].entity) -/* - * TODO: Get rid of this. - */ -#define MEDIA_ENTITY_MAX_PADS 512 - /** * media_graph_walk_init - Allocate resources for graph walk * @graph: Media graph structure that will be used to walk the graph