media: coda: allocate space for mpeg4 decoder mvcol buffer

The MPEG-4 decoder mvcol buffer was registered, but its size not added
to a frame buffer allocation. This could cause the decoder to write past
the end of the allocated buffer for large frame sizes.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
index 87002bede5ea1d8f3270b78e24a56661e36b18cf..32db1227d0258fc0459b096ebf2c9e2700f5de83 100644 (file)
--- a/drivers/media/platform/coda/coda-bit.c
+++ b/drivers/media/platform/coda/coda-bit.c
@@ -414,8 +414,10 @@ static int coda_alloc_framebuffers(struct coda_ctx *ctx,
                        size = round_up(ysize, 4096) + ysize / 2;
                else
                        size = ysize + ysize / 2;
-               if (ctx->codec->src_fourcc == V4L2_PIX_FMT_H264 &&
-                   dev->devtype->product != CODA_DX6)
+               /* Add space for mvcol buffers */
+               if (dev->devtype->product != CODA_DX6 &&
+                   (ctx->codec->src_fourcc == V4L2_PIX_FMT_H264 ||
+                    (ctx->codec->src_fourcc == V4L2_PIX_FMT_MPEG4 && i == 0)))
                        size += ysize / 4;
                name = kasprintf(GFP_KERNEL, "fb%d", i);
                if (!name) {