Problematic code in media/v4l2-core/v4l2-mem2mem.c

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello everyone,

I think I brought up this issue before but didn't resolve it completely. Now I'd like to double check this and if we can agree on it, I'd also like to submit a patch to fix it. The problem is that function `get_queue_ctx` can never return a NULL pointer unless pointer overflow occurs, which is very unlikely. To be more specific,

```
static struct v4l2_m2m_queue_ctx *get_queue_ctx(struct v4l2_m2m_ctx *m2m_ctx,
						enum v4l2_buf_type type)
{
	if (V4L2_TYPE_IS_OUTPUT(type))
		return &m2m_ctx->out_q_ctx;
	else
		return &m2m_ctx->cap_q_ctx;
}
```

The address returned by this function is either `(char*)m2m_ctx+968` or `(char*)m2m_ctx+16`, so for it to be NULL, `m2m_ctx` must be a large unsigned value. Yet the return value of this function is NULL-checked, for example in v4l2_m2m_get_vq.

Please let me know if it makes sense.

Best,
Shaobo



[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]

  Powered by Linux