Messages in this thread Patch in this message | | | From | yqsun1997@gmail ... | Subject | [PATCH] OOB read and write in mtk multiple places | Date | Tue, 27 Jun 2023 16:10:02 +0800 |
| |
From: yqsun1997 <yqsun1997@gmail.com>
The num_planes max index is 8, but bytesperline and bytesperline in struct mtk_q_data, The max index is MTK_VCODEC_MAX_PLANES == 3, so will cause OOB read and write in multiple places.like vidioc_venc_g_fmt same as commit 8fbcf730
Signed-off-by: yqsun1997 <yqsun1997@gmail.com> --- drivers/media/platform/mediatek/vcodec/mtk_vcodec_drv.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_drv.h b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_drv.h index 9acab54fd..c2c157675 100644 --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_drv.h +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_drv.h @@ -22,7 +22,7 @@ #define MTK_VCODEC_DEC_NAME "mtk-vcodec-dec" #define MTK_VCODEC_ENC_NAME "mtk-vcodec-enc" -#define MTK_VCODEC_MAX_PLANES 3 +#define MTK_VCODEC_MAX_PLANES 8 #define MTK_V4L2_BENCHMARK 0 #define WAIT_INTR_TIMEOUT_MS 1000 #define IS_VDEC_LAT_ARCH(hw_arch) ((hw_arch) >= MTK_VDEC_LAT_SINGLE_CORE) -- 2.39.2
| |