diff options
| author | miaohong chen <miaohong.chen@amlogic.com> | 2020-12-17 13:53:13 +0800 |
|---|---|---|
| committer | Hui Zhang <hui.zhang@amlogic.com> | 2020-12-24 02:03:49 -0800 |
| commit | e6b95fd8ea67c54d1226d4a2a40828f7d4ce12d4 (patch) | |
| tree | 867741165b9210c2419911ca1493174f66e4f62d | |
| parent | afb96daf5422f94183f249cd1695f6d1a5cf254f (diff) | |
| download | media_modules-e6b95fd8ea67c54d1226d4a2a40828f7d4ce12d4.tar.gz | |
mpeg2: pip user data pushing crash [1/1]
PD#SWPL-39533
Problem:
wrong user data over size causes crash.
Solution:
limit user data pushing size
Verify:
AH212
Change-Id: I581429122d39803cbe1b00280575f94b7a71812c
Signed-off-by: miaohong chen <miaohong.chen@amlogic.com>
| -rw-r--r-- | drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c index 1fb6209..5bf0a8a 100644 --- a/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c +++ b/drivers/frame_provider/decoder/mpeg12/vmpeg12_multi.c @@ -1372,9 +1372,9 @@ static void userdata_push_do_work(struct work_struct *work) } cur_wp = reg & 0x7fff; - if (cur_wp == hw->ucode_cc_last_wp) { + if (cur_wp == hw->ucode_cc_last_wp || (cur_wp >= AUX_BUF_ALIGN(CCBUF_SIZE))) { debug_print(DECODE_ID(hw), 0, - "Null user data package: wp = %d\n", cur_wp); + "Null or Over size user data package: wp = %d\n", cur_wp); WRITE_VREG(AV_SCRATCH_J, 0); return; } @@ -1482,7 +1482,7 @@ static void userdata_push_do_work(struct work_struct *work) hw->userdata_info.last_wp += data_length; if (hw->userdata_info.last_wp >= USER_DATA_SIZE) - hw->userdata_info.last_wp -= USER_DATA_SIZE; + hw->userdata_info.last_wp %= USER_DATA_SIZE; hw->wait_for_udr_send = 1; |