leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

V4L/DVB (8920): cx18/ivtv: fix check of window boundaries for VIDIOC_S_FMT

Browse Source 
It was possible to set out-of-bounds windows sizes, this is now
fixed.

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Hans Verkuil 2008-09-06 08:24:37 -03:00 committed by Mauro Carvalho Chehab
parent ff5f26b40a
commit effc3466d3
2 changed files with 14 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/media/video/cx18/cx18-ioctl.c
View File

@ -171,7 +171,6 @@ static int cx18_try_fmt_vid_cap(struct file *file, void *fh,
{ {
struct cx18_open_id *id = fh; struct cx18_open_id *id = fh;
struct cx18 *cx = id->cx; struct cx18 *cx = id->cx;
int w = fmt->fmt.pix.width; int w = fmt->fmt.pix.width;
int h = fmt->fmt.pix.height; int h = fmt->fmt.pix.height;
@ -203,8 +202,7 @@ static int cx18_s_fmt_vid_cap(struct file *file, void *fh,
struct cx18_open_id *id = fh; struct cx18_open_id *id = fh;
struct cx18 *cx = id->cx; struct cx18 *cx = id->cx;
int ret; int ret;
int w = fmt->fmt.pix.width; int w, h;
int h = fmt->fmt.pix.height;
ret = v4l2_prio_check(&cx->prio, &id->prio); ret = v4l2_prio_check(&cx->prio, &id->prio);
if (ret) if (ret)
@ -213,6 +211,8 @@ static int cx18_s_fmt_vid_cap(struct file *file, void *fh,
ret = cx18_try_fmt_vid_cap(file, fh, fmt); ret = cx18_try_fmt_vid_cap(file, fh, fmt);
if (ret) if (ret)
return ret; return ret;
w = fmt->fmt.pix.width;
h = fmt->fmt.pix.height;
if (cx->params.width == w && cx->params.height == h) if (cx->params.width == w && cx->params.height == h)
return 0; return 0;

29
drivers/media/video/ivtv/ivtv-ioctl.c
View File

@ -512,27 +512,20 @@ static int ivtv_try_fmt_sliced_vbi_cap(struct file *file, void *fh, struct v4l2_
static int ivtv_try_fmt_vid_out(struct file *file, void *fh, struct v4l2_format *fmt) static int ivtv_try_fmt_vid_out(struct file *file, void *fh, struct v4l2_format *fmt)
{ {
struct ivtv_open_id *id = fh; struct ivtv_open_id *id = fh;
s32 w, h; s32 w = fmt->fmt.pix.width;
int field; s32 h = fmt->fmt.pix.height;
int ret; int field = fmt->fmt.pix.field;
int ret = ivtv_g_fmt_vid_out(file, fh, fmt);
w = fmt->fmt.pix.width;
h = fmt->fmt.pix.height;
field = fmt->fmt.pix.field;
ret = ivtv_g_fmt_vid_out(file, fh, fmt);
fmt->fmt.pix.width = w;
fmt->fmt.pix.height = h;
if (!ret && id->type == IVTV_DEC_STREAM_TYPE_YUV) { if (!ret && id->type == IVTV_DEC_STREAM_TYPE_YUV) {
fmt->fmt.pix.field = field; fmt->fmt.pix.field = field;
if (fmt->fmt.pix.width < 2) w = min(w, 720);
fmt->fmt.pix.width = 2; w = max(w, 2);
if (fmt->fmt.pix.width > 720) h = min(h, 576);
fmt->fmt.pix.width = 720; h = max(h, 2);
if (fmt->fmt.pix.height < 2)
fmt->fmt.pix.height = 2;
if (fmt->fmt.pix.height > 576)
fmt->fmt.pix.height = 576;
} }
fmt->fmt.pix.width = w;
fmt->fmt.pix.height = h;
return ret; return ret;
} }
@ -560,9 +553,9 @@ static int ivtv_s_fmt_vid_cap(struct file *file, void *fh, struct v4l2_format *f
struct ivtv_open_id *id = fh; struct ivtv_open_id *id = fh;
struct ivtv *itv = id->itv; struct ivtv *itv = id->itv;
struct cx2341x_mpeg_params *p = &itv->params; struct cx2341x_mpeg_params *p = &itv->params;
int ret = ivtv_try_fmt_vid_cap(file, fh, fmt);
int w = fmt->fmt.pix.width; int w = fmt->fmt.pix.width;
int h = fmt->fmt.pix.height; int h = fmt->fmt.pix.height;
int ret = ivtv_try_fmt_vid_cap(file, fh, fmt);
if (ret) if (ret)
return ret; return ret;