diff mbox

[media] uvcvideo: Check format and frame size in VIDIOC_CREATE_BUFS

Message ID 1391425477-3889-1-git-send-email-p.zabel@pengutronix.de (mailing list archive)
State New, archived
Headers show

Commit Message

Philipp Zabel Feb. 3, 2014, 11:04 a.m. UTC 
Verify that create_bufs requests buffers with the currently selected
format and frame size, return an error otherwise.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
---
 drivers/media/usb/uvc/uvc_v4l2.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
diff mbox

Patch

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 2cea127..fae61a2 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -1003,10 +1003,24 @@  static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
 	case VIDIOC_CREATE_BUFS:
 	{
 		struct v4l2_create_buffers *cb = arg;
+		struct v4l2_pix_format *pix;
+		struct uvc_format *format;
+		struct uvc_frame *frame;
 
 		if (!uvc_has_privileges(handle))
 			return -EBUSY;
 
+		format = stream->cur_format;
+		frame = stream->cur_frame;
+		pix = &cb->format.fmt.pix;
+
+		if (pix->pixelformat != format->fcc ||
+		    pix->width != frame->wWidth ||
+		    pix->height != frame->wHeight ||
+		    pix->bytesperline != format->bpp * frame->wWidth / 8 ||
+		    pix->sizeimage != stream->ctrl.dwMaxVideoFrameSize)
+			return -EINVAL;
+
 		return uvc_create_buffers(&stream->queue, cb);
 	}