From a629f86b4aa1669ddf2afaa3ded66d5a59d60b77 Mon Sep 17 00:00:00 2001 From: Sylwester Nawrocki Date: Mon, 23 May 2011 09:15:05 -0300 Subject: [PATCH] [media] s5p-fimc: Fix wrong buffer size in queue_setup Avoid dereferencing of NULL f->fmt. Correct size of the allocated buffer in case the crop rectangle is smaller than the bounds rectangle (configured with S_FMT). Also remove redundant check for *num_buffer == 0 as this case is handled in videobuf2. Signed-off-by: Sylwester Nawrocki Signed-off-by: Kyungmin Park Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/s5p-fimc/fimc-core.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c index c427edd3cd5e..85b47a328a5d 100644 --- a/drivers/media/video/s5p-fimc/fimc-core.c +++ b/drivers/media/video/s5p-fimc/fimc-core.c @@ -704,22 +704,18 @@ static int fimc_queue_setup(struct vb2_queue *vq, unsigned int *num_buffers, f = ctx_get_frame(ctx, vq->type); if (IS_ERR(f)) return PTR_ERR(f); - /* * Return number of non-contigous planes (plane buffers) * depending on the configured color format. */ - if (f->fmt) - *num_planes = f->fmt->memplanes; + if (!f->fmt) + return -EINVAL; + *num_planes = f->fmt->memplanes; for (i = 0; i < f->fmt->memplanes; i++) { - sizes[i] = (f->width * f->height * f->fmt->depth[i]) >> 3; + sizes[i] = (f->f_width * f->f_height * f->fmt->depth[i]) / 8; allocators[i] = ctx->fimc_dev->alloc_ctx; } - - if (*num_buffers == 0) - *num_buffers = 1; - return 0; }