From 30d4554a02d3ad6f9928767c9f98214775f4dcb2 Mon Sep 17 00:00:00 2001 From: Jean-François Moine Date: Mon, 26 Jul 2010 06:47:35 -0300 Subject: V4L/DVB: gspca - main: Version change MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jean-François Moine Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/gspca/gspca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/media/video/gspca/gspca.c') diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c index d951b0f0e05..0004469691c 100644 --- a/drivers/media/video/gspca/gspca.c +++ b/drivers/media/video/gspca/gspca.c @@ -55,7 +55,7 @@ MODULE_AUTHOR("Jean-François Moine "); MODULE_DESCRIPTION("GSPCA USB Camera Driver"); MODULE_LICENSE("GPL"); -#define DRIVER_VERSION_NUMBER KERNEL_VERSION(2, 9, 0) +#define DRIVER_VERSION_NUMBER KERNEL_VERSION(2, 10, 0) #ifdef GSPCA_DEBUG int gspca_debug = D_ERR | D_PROBE; -- cgit v1.2.3-70-g09d2 From fe988f56c7c1bff52a4c26164ceb3dbd582de433 Mon Sep 17 00:00:00 2001 From: Jean-François Moine Date: Thu, 29 Jul 2010 02:46:02 -0300 Subject: V4L/DVB: gspca - main: Fix a crash in gspca_frame_add() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Some webcams as ov511 may find many times an end of image. In this case, with the last patch in image concatenation (commit 799b1bd41f398054d46fd35f73abd01c4009f6ca), the image pointer was NULL and the system crashed in memcpy(). Signed-off-by: Jean-François Moine Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/gspca/gspca.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) (limited to 'drivers/media/video/gspca/gspca.c') diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c index 0004469691c..b9846106913 100644 --- a/drivers/media/video/gspca/gspca.c +++ b/drivers/media/video/gspca/gspca.c @@ -440,10 +440,15 @@ void gspca_frame_add(struct gspca_dev *gspca_dev, frame->v4l2_buf.sequence = ++gspca_dev->sequence; gspca_dev->image = frame->data; gspca_dev->image_len = 0; - } else if (gspca_dev->last_packet_type == DISCARD_PACKET) { - if (packet_type == LAST_PACKET) - gspca_dev->last_packet_type = packet_type; - return; + } else { + switch (gspca_dev->last_packet_type) { + case DISCARD_PACKET: + if (packet_type == LAST_PACKET) + gspca_dev->last_packet_type = packet_type; + return; + case LAST_PACKET: + return; + } } /* append the packet to the frame buffer */ @@ -454,6 +459,12 @@ void gspca_frame_add(struct gspca_dev *gspca_dev, gspca_dev->frsz); packet_type = DISCARD_PACKET; } else { +/* !! image is NULL only when last pkt is LAST or DISCARD + if (gspca_dev->image == NULL) { + err("gspca_frame_add() image == NULL"); + return; + } + */ memcpy(gspca_dev->image + gspca_dev->image_len, data, len); gspca_dev->image_len += len; -- cgit v1.2.3-70-g09d2