diff options
| author | Wayne Zou <b36644@freescale.com> | 2012-04-28 17:13:25 +0800 |
|---|---|---|
| committer | Jason Liu <r64343@freescale.com> | 2012-07-20 13:36:53 +0800 |
| commit | 4c5032b87b73dc2a1cd3a8a2868c153fdf0d9a77 (patch) | |
| tree | 2105772aa412df22b07609bf5fa0348483c582cd /drivers/media/video/mxc/output | |
| parent | 5ae709c84723071800c4539d7af431441ab2094a (diff) | |
ENGR00180103-1 V4L2: use copy_from/to_user() for user space pointer
V4L2: use copy_from/to_user() for user space pointer
Signed-off-by: Wayne Zou <b36644@freescale.com>
Diffstat (limited to 'drivers/media/video/mxc/output')
| -rw-r--r-- | drivers/media/video/mxc/output/mxc_vout.c | 38 |
1 files changed, 23 insertions, 15 deletions
diff --git a/drivers/media/video/mxc/output/mxc_vout.c b/drivers/media/video/mxc/output/mxc_vout.c index 8364a33e2726..5f1deeeff76b 100644 --- a/drivers/media/video/mxc/output/mxc_vout.c +++ b/drivers/media/video/mxc/output/mxc_vout.c @@ -848,7 +848,7 @@ static int mxc_vidioc_g_fmt_vid_out(struct file *file, void *fh, struct v4l2_format *f) { struct mxc_vout_output *vout = fh; - struct v4l2_rect *rect = NULL; + struct v4l2_rect rect; f->fmt.pix.width = vout->task.input.width; f->fmt.pix.height = vout->task.input.height; @@ -856,11 +856,13 @@ static int mxc_vidioc_g_fmt_vid_out(struct file *file, void *fh, f->fmt.pix.sizeimage = get_frame_size(vout); if (f->fmt.pix.priv) { - rect = (struct v4l2_rect *)f->fmt.pix.priv; - rect->left = vout->task.input.crop.pos.x; - rect->top = vout->task.input.crop.pos.y; - rect->width = vout->task.input.crop.w; - rect->height = vout->task.input.crop.h; + rect.left = vout->task.input.crop.pos.x; + rect.top = vout->task.input.crop.pos.y; + rect.width = vout->task.input.crop.w; + rect.height = vout->task.input.crop.h; + if (copy_to_user((void __user *)f->fmt.pix.priv, + &rect, sizeof(rect))) + return -EFAULT; } v4l2_dbg(1, debug, vout->vfd->v4l2_dev, "frame_size:0x%x, pix_fmt:0x%x\n", @@ -1048,11 +1050,15 @@ static int mxc_vout_try_task(struct mxc_vout_output *vout) static int mxc_vout_try_format(struct mxc_vout_output *vout, struct v4l2_format *f) { int ret = 0; - struct v4l2_rect *rect = NULL; + struct v4l2_rect rect; u32 o_height = 0; u32 ocrop_h = 0; u32 is_1080p; + if (f->fmt.pix.priv && copy_from_user(&rect, + (void __user *)f->fmt.pix.priv, sizeof(rect))) + return -EFAULT; + vout->task.input.width = f->fmt.pix.width; vout->task.input.height = f->fmt.pix.height; vout->task.input.format = f->fmt.pix.pixelformat; @@ -1094,11 +1100,10 @@ static int mxc_vout_try_format(struct mxc_vout_output *vout, struct v4l2_format } if (f->fmt.pix.priv) { - rect = (struct v4l2_rect *)f->fmt.pix.priv; - vout->task.input.crop.pos.x = rect->left; - vout->task.input.crop.pos.y = rect->top; - vout->task.input.crop.w = rect->width; - vout->task.input.crop.h = rect->height; + vout->task.input.crop.pos.x = rect.left; + vout->task.input.crop.pos.y = rect.top; + vout->task.input.crop.w = rect.width; + vout->task.input.crop.h = rect.height; } else { vout->task.input.crop.pos.x = 0; vout->task.input.crop.pos.y = 0; @@ -1117,9 +1122,12 @@ static int mxc_vout_try_format(struct mxc_vout_output *vout, struct v4l2_format ret = mxc_vout_try_task(vout); if (!ret) { - if (rect) { - rect->width = vout->task.input.crop.w; - rect->height = vout->task.input.crop.h; + if (f->fmt.pix.priv) { + rect.width = vout->task.input.crop.w; + rect.height = vout->task.input.crop.h; + if (copy_to_user((void __user *)f->fmt.pix.priv, + &rect, sizeof(rect))) + ret = -EFAULT; } else { f->fmt.pix.width = vout->task.input.crop.w; f->fmt.pix.height = vout->task.input.crop.h; |