diff --git a/drivers/media/video_processor/v4lvideo/v4lvideo.c b/drivers/media/video_processor/v4lvideo/v4lvideo.c index 82bbb57f6..4d983680b 100644 --- a/drivers/media/video_processor/v4lvideo/v4lvideo.c +++ b/drivers/media/video_processor/v4lvideo/v4lvideo.c @@ -1218,13 +1218,20 @@ void v4lvideo_data_copy(struct v4l_data_t *v4l_data, return; } - pr_debug("%s: vf->type: %d vf->compWidth: %d\n", - __func__, vf->type, vf->compWidth); + pr_debug("%s: vf->type:%d vf->compWidth:%d vf->compHeight:%d\n", + __func__, vf->type, vf->compWidth, vf->compHeight); + pr_debug("vf->width:%d vf->height:%d v4l_data->width:%d v4l_data->height:%d\n", + vf->width, vf->height, v4l_data->width, v4l_data->height); /* * fbc decoder for VIDTYPE_COMPRESS */ if ((vf->type & VIDTYPE_COMPRESS)) { + if (vf->compWidth > v4l_data->width || vf->compHeight > v4l_data->height) { + pr_err("%s: afbc video WxH larger than buffer WxH.\n", __func__); + return; + } + if (print_flag) pr_info("fbc decoder path\n"); if ((vf->bitdepth & BITDEPTH_YMASK) == BITDEPTH_Y10) @@ -1282,6 +1289,11 @@ void v4lvideo_data_copy(struct v4l_data_t *v4l_data, /* * GE2D copy for non-compress */ + if (vf->width > v4l_data->width || vf->height > v4l_data->height) { + pr_err("%s: none-afbc video WxH larger than buffer WxH.\n", __func__); + return; + } + is_10bit = vf->bitdepth & BITDEPTH_Y10; di_mode = vf->type & VIDTYPE_DI_PW; if (is_10bit && !di_mode) {