summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorFrank Schaefer <fschaefer.oss@googlemail.com>2012-11-25 09:37:33 (GMT)
committerMauro Carvalho Chehab <mchehab@redhat.com>2012-12-22 21:16:10 (GMT)
commit3610f58bb1d545fe3f3767ec8ca3251383e9c728 (patch)
tree570138953f205934cb960c2f1fbff28a137c0d14
parentb77e0c088f07817ecfc4e0a34d4d6a3f99a3ecaf (diff)
downloadlinux-fsl-qoriq-3610f58bb1d545fe3f3767ec8ca3251383e9c728.tar.xz
[media] em28xx: make sure the packet size is >= 4 before checking for headers in em28xx_urb_data_copy_vbi()
Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
-rw-r--r--drivers/media/usb/em28xx/em28xx-video.c45
1 files changed, 24 insertions, 21 deletions
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index fec8847..da31fd4 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -576,7 +576,7 @@ static inline int em28xx_urb_data_copy_vbi(struct em28xx *dev, struct urb *urb)
urb->iso_frame_desc[i].offset;
}
- if (actual_length <= 0) {
+ if (actual_length == 0) {
/* NOTE: happens very often with isoc transfers */
/* em28xx_usbdbg("packet %d is empty",i); - spammy */
continue;
@@ -585,27 +585,30 @@ static inline int em28xx_urb_data_copy_vbi(struct em28xx *dev, struct urb *urb)
/* capture type 0 = vbi start
capture type 1 = video start
capture type 2 = video in progress */
- if (p[0] == 0x33 && p[1] == 0x95) {
- dev->capture_type = 0;
- dev->vbi_read = 0;
- em28xx_isocdbg("VBI START HEADER!!!\n");
- dev->cur_field = p[2];
- p += 4;
- len = actual_length - 4;
- } else if (p[0] == 0x88 && p[1] == 0x88 &&
- p[2] == 0x88 && p[3] == 0x88) {
- /* continuation */
- p += 4;
- len = actual_length - 4;
- } else if (p[0] == 0x22 && p[1] == 0x5a) {
- /* start video */
- p += 4;
- len = actual_length - 4;
- } else {
- /* NOTE: With bulk transfers, intermediate data packets
- * have no continuation header */
- len = actual_length;
+ len = actual_length;
+ if (len >= 4) {
+ /* NOTE: headers are always 4 bytes and
+ * never split across packets */
+ if (p[0] == 0x33 && p[1] == 0x95) {
+ dev->capture_type = 0;
+ dev->vbi_read = 0;
+ em28xx_isocdbg("VBI START HEADER!!!\n");
+ dev->cur_field = p[2];
+ p += 4;
+ len -= 4;
+ } else if (p[0] == 0x88 && p[1] == 0x88 &&
+ p[2] == 0x88 && p[3] == 0x88) {
+ /* continuation */
+ p += 4;
+ len -= 4;
+ } else if (p[0] == 0x22 && p[1] == 0x5a) {
+ /* start video */
+ p += 4;
+ len -= 4;
+ }
}
+ /* NOTE: with bulk transfers, intermediate data packets
+ * have no continuation header */
vbi_size = dev->vbi_width * dev->vbi_height;