Michael Bommarito 81ad46bb33 media: rkvdec: bound HEVC tile loops and PPS id to the array capacity ... compute_tiles_uniform() and compute_tiles_non_uniform() loop over num_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and assemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile and indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from the untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of assemble_hw_pps() before indexing priv_tbl->param_set[] with an out-of-range pic_parameter_set_id, so the writes stay within the hardware tables. Fixes: 3595375c23 ("media: rkvdec: Add HEVC backend") Fixes: c9a59dc2ac ("media: rkvdec: Add HEVC support for the VDPU381 variant") Assisted-by: Claude:claude-opus-4-8 Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>		2026-09-07 09:01:05 +02:00
..
rga	media: rockchip: rga: don't change RGB quantization	2026-07-17 12:36:15 +02:00
rkcif	media: rockchip: rkcif: add support for rk3588 vicap mipi capture	2026-05-28 22:10:02 +03:00
rkisp1	media: rkisp1: Add support for CAC	2026-05-21 07:41:32 +02:00
rkvdec	media: rkvdec: bound HEVC tile loops and PPS id to the array capacity	2026-09-07 09:01:05 +02:00
Kconfig	media: rockchip: add driver for the rockchip camera interface	2025-11-15 12:40:33 +01:00
Makefile	media: rockchip: add driver for the rockchip camera interface	2025-11-15 12:40:33 +01:00