hc
2024-05-13 9d77db3c730780c8ef5ccd4b66403ff5675cfe4e
kernel/drivers/media/dvb-core/dvb_vb2.c
....@@ -146,8 +146,7 @@
146146 dprintk(3, "[%s]\n", ctx->name);
147147 }
148148
149
-static int _fill_vb2_buffer(struct vb2_buffer *vb,
150
- const void *pb, struct vb2_plane *planes)
149
+static int _fill_vb2_buffer(struct vb2_buffer *vb, struct vb2_plane *planes)
151150 {
152151 struct dvb_vb2_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
153152
....@@ -194,7 +193,7 @@
194193 spin_lock_init(&ctx->slock);
195194 INIT_LIST_HEAD(&ctx->dvb_q);
196195
197
- strlcpy(ctx->name, name, DVB_VB2_NAME_MAX);
196
+ strscpy(ctx->name, name, DVB_VB2_NAME_MAX);
198197 ctx->nonblocking = nonblocking;
199198 ctx->state = DVB_VB2_STATE_INIT;
200199
....@@ -359,6 +358,12 @@
359358
360359 int dvb_vb2_querybuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
361360 {
361
+ struct vb2_queue *q = &ctx->vb_q;
362
+
363
+ if (b->index >= q->num_buffers) {
364
+ dprintk(1, "[%s] buffer index out of range\n", ctx->name);
365
+ return -EINVAL;
366
+ }
362367 vb2_core_querybuf(&ctx->vb_q, b->index, b);
363368 dprintk(3, "[%s] index=%d\n", ctx->name, b->index);
364369 return 0;
....@@ -383,9 +388,14 @@
383388
384389 int dvb_vb2_qbuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
385390 {
391
+ struct vb2_queue *q = &ctx->vb_q;
386392 int ret;
387393
388
- ret = vb2_core_qbuf(&ctx->vb_q, b->index, b);
394
+ if (b->index >= q->num_buffers) {
395
+ dprintk(1, "[%s] buffer index out of range\n", ctx->name);
396
+ return -EINVAL;
397
+ }
398
+ ret = vb2_core_qbuf(&ctx->vb_q, b->index, b, NULL);
389399 if (ret) {
390400 dprintk(1, "[%s] index=%d errno=%d\n", ctx->name,
391401 b->index, ret);