From: Chad Fraleigh Date: Sun, 29 Aug 2021 23:51:27 +0000 (+0200) Subject: media: gspca: Limit frame size to sizeimage. X-Git-Tag: v6.1-rc5~2566^2~158 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=936c7daa4d99c0c5d10c97cb9afc28966d547d80;p=platform%2Fkernel%2Flinux-starfive.git media: gspca: Limit frame size to sizeimage. Limit frame size to what userland code expects. This can happen when cameras, such as Kensington VideoCAM, use fixed sized transfer packets which includes trailing junk in the final packet. Signed-off-by: Chad Fraleigh Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c index 47d8f28..770714c 100644 --- a/drivers/media/usb/gspca/gspca.c +++ b/drivers/media/usb/gspca/gspca.c @@ -444,6 +444,8 @@ void gspca_frame_add(struct gspca_dev *gspca_dev, * next first packet, wake up the application and advance * in the queue */ if (packet_type == LAST_PACKET) { + if (gspca_dev->image_len > gspca_dev->pixfmt.sizeimage) + gspca_dev->image_len = gspca_dev->pixfmt.sizeimage; spin_lock_irqsave(&gspca_dev->qlock, flags); list_del(&buf->list); spin_unlock_irqrestore(&gspca_dev->qlock, flags);