Michael Bommarito 37bef2170d media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity ... vdec_av1_slice_setup_tile() copies tile_cols + 1 / tile_rows + 1 entries into mi_col_starts[] / mi_row_starts[] from the bitstream tile_info. Bound the copy to the array capacity. Fixes: 0934d37596 ("media: mediatek: vcodec: separate decoder and encoder") Assisted-by: Claude:claude-opus-4-8 Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>		2026-09-07 09:01:05 +02:00
..
vdec	media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity	2026-09-07 09:01:05 +02:00
Makefile
mtk_vcodec_dec_drv.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
mtk_vcodec_dec_drv.h	media: mediatek: vcodec: Implement manual request completion	2026-01-05 15:56:31 +01:00
mtk_vcodec_dec_hw.c
mtk_vcodec_dec_hw.h
mtk_vcodec_dec_pm.c	media: mediatek: vcodec: Discard pm_runtime_put() return value	2026-01-13 09:41:59 +01:00
mtk_vcodec_dec_pm.h
mtk_vcodec_dec_stateful.c	media: platform: drop vb2_ops_wait_prepare/finish	2024-10-28 09:20:07 +01:00
mtk_vcodec_dec_stateless.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
mtk_vcodec_dec.c	media: mediatek: vcodec: Implement manual request completion	2026-01-05 15:56:31 +01:00
mtk_vcodec_dec.h	media: mediatek: vcodec: Fix kerneldoc	2024-02-05 12:57:45 +01:00
vdec_drv_base.h
vdec_drv_if.c
vdec_drv_if.h
vdec_ipi_msg.h
vdec_msg_queue.c
vdec_msg_queue.h	media: mediatek: vcodec: Fix multiple typos	2024-03-25 10:13:43 +01:00
vdec_vpu_if.c	media: mediatek: vcodec: use = { } instead of memset()	2026-01-05 15:56:31 +01:00
vdec_vpu_if.h	media: mediatek: vcodec: Fix multiple typos	2024-03-25 10:13:43 +01:00