Michael Bommarito 37bef2170d media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity ... vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound the copy to the array capacity. Fixes: 0934d37596 ("media: mediatek: vcodec: separate decoder and encoder") Assisted-by: Claude:claude-opus-4-8 Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>		2026-09-07 09:01:05 +02:00
..
common	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
decoder	media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity	2026-09-07 09:01:05 +02:00
encoder	media: mediatek: vcodec: fix use-after-free in encoder release path	2026-03-23 11:18:34 +01:00
Kconfig	media: drop CONFIG_MEDIA_CONTROLLER_REQUEST_API	2023-11-23 13:03:45 +01:00
Makefile	media: mediatek: vcodec: separate decoder and encoder	2023-08-10 07:58:34 +02:00