github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/drivers/media/test-drivers/vicodec
History
Junrui Luo cf4500ebf6 media: vicodec: fix out-of-bounds write in FWHT encoder 
vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the
compressed descriptor pixfmt_fwht, whose sizeimage_mult is 3:
coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame()
encodes one plane per component, and an incompressible plane takes the
FWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.

For a 4-component pixel format all four planes are full resolution
(width_div == height_div == 1), so a frame that forces every plane
through the unencoded fallback writes
sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning
the plane by coded_w * coded_h, which can result in corruption
of adjacent kernel heap memory.

Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest
components_num among the supported raw formats, so the capture buffer is
always large enough for the unencoded fallback.

Fixes: 16ecf6dff9 ("media: vicodec: Add support for 4 planes formats")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-07-15 15:31:24 +02:00
..
codec-fwht.c treewide: update LLVM Bugzilla links 2024-02-22 15:38:51 -08:00
codec-fwht.h media: vicodec: mark the stateless FWHT API as stable 2020-12-03 12:27:33 +01:00
codec-v4l2-fwht.c media: vicodec: add V4L2_ prefix before FWHT_VERSION and FWHT_FL_* 2020-12-03 12:27:33 +01:00
codec-v4l2-fwht.h
Kconfig media: drop CONFIG_MEDIA_CONTROLLER_REQUEST_API 2023-11-23 13:03:45 +01:00
Makefile
vicodec-core.c media: vicodec: fix out-of-bounds write in FWHT encoder 2026-07-15 15:31:24 +02:00