From 899d46f056793812182b64056e3a6cb0362a8373 Mon Sep 17 00:00:00 2001 From: Wayne Zou Date: Sat, 28 Apr 2012 17:13:25 +0800 Subject: [PATCH] ENGR00180103-1 V4L2: use copy_from/to_user() for user space pointer V4L2: use copy_from/to_user() for user space pointer Signed-off-by: Wayne Zou --- drivers/media/video/mxc/output/mxc_vout.c | 38 ++++++++++++++--------- 1 file changed, 23 insertions(+), 15 deletions(-) diff --git a/drivers/media/video/mxc/output/mxc_vout.c b/drivers/media/video/mxc/output/mxc_vout.c index 8364a33e2726..5f1deeeff76b 100644 --- a/drivers/media/video/mxc/output/mxc_vout.c +++ b/drivers/media/video/mxc/output/mxc_vout.c @@ -848,7 +848,7 @@ static int mxc_vidioc_g_fmt_vid_out(struct file *file, void *fh, struct v4l2_format *f) { struct mxc_vout_output *vout = fh; - struct v4l2_rect *rect = NULL; + struct v4l2_rect rect; f->fmt.pix.width = vout->task.input.width; f->fmt.pix.height = vout->task.input.height; @@ -856,11 +856,13 @@ static int mxc_vidioc_g_fmt_vid_out(struct file *file, void *fh, f->fmt.pix.sizeimage = get_frame_size(vout); if (f->fmt.pix.priv) { - rect = (struct v4l2_rect *)f->fmt.pix.priv; - rect->left = vout->task.input.crop.pos.x; - rect->top = vout->task.input.crop.pos.y; - rect->width = vout->task.input.crop.w; - rect->height = vout->task.input.crop.h; + rect.left = vout->task.input.crop.pos.x; + rect.top = vout->task.input.crop.pos.y; + rect.width = vout->task.input.crop.w; + rect.height = vout->task.input.crop.h; + if (copy_to_user((void __user *)f->fmt.pix.priv, + &rect, sizeof(rect))) + return -EFAULT; } v4l2_dbg(1, debug, vout->vfd->v4l2_dev, "frame_size:0x%x, pix_fmt:0x%x\n", @@ -1048,11 +1050,15 @@ static int mxc_vout_try_task(struct mxc_vout_output *vout) static int mxc_vout_try_format(struct mxc_vout_output *vout, struct v4l2_format *f) { int ret = 0; - struct v4l2_rect *rect = NULL; + struct v4l2_rect rect; u32 o_height = 0; u32 ocrop_h = 0; u32 is_1080p; + if (f->fmt.pix.priv && copy_from_user(&rect, + (void __user *)f->fmt.pix.priv, sizeof(rect))) + return -EFAULT; + vout->task.input.width = f->fmt.pix.width; vout->task.input.height = f->fmt.pix.height; vout->task.input.format = f->fmt.pix.pixelformat; @@ -1094,11 +1100,10 @@ static int mxc_vout_try_format(struct mxc_vout_output *vout, struct v4l2_format } if (f->fmt.pix.priv) { - rect = (struct v4l2_rect *)f->fmt.pix.priv; - vout->task.input.crop.pos.x = rect->left; - vout->task.input.crop.pos.y = rect->top; - vout->task.input.crop.w = rect->width; - vout->task.input.crop.h = rect->height; + vout->task.input.crop.pos.x = rect.left; + vout->task.input.crop.pos.y = rect.top; + vout->task.input.crop.w = rect.width; + vout->task.input.crop.h = rect.height; } else { vout->task.input.crop.pos.x = 0; vout->task.input.crop.pos.y = 0; @@ -1117,9 +1122,12 @@ static int mxc_vout_try_format(struct mxc_vout_output *vout, struct v4l2_format ret = mxc_vout_try_task(vout); if (!ret) { - if (rect) { - rect->width = vout->task.input.crop.w; - rect->height = vout->task.input.crop.h; + if (f->fmt.pix.priv) { + rect.width = vout->task.input.crop.w; + rect.height = vout->task.input.crop.h; + if (copy_to_user((void __user *)f->fmt.pix.priv, + &rect, sizeof(rect))) + ret = -EFAULT; } else { f->fmt.pix.width = vout->task.input.crop.w; f->fmt.pix.height = vout->task.input.crop.h; -- 2.39.5