Commits
Liu Ying committed e58e8f71a97
MLK-12670 mxc IPUv3: common: Fix overrun array ->sec_chan_en and ->thrd_chan_en
We've got more than 24 channels defined in ipu_channel_t, which causes
potential overrun on array ipu->sec_chan_en and ipu->thrd_chan_en.
This patch enlarges the array size to IPU_MAX_CH(32) to fix this issue.
This issue is reported by Coverity:
Out-of-bounds read (OVERRUN)
overrun-local: Overrunning array ipu->sec_chan_en of 24 bytes at byte offset
25 using index channel >> 24 (which evaluates to 25).
if ((ipu->sec_chan_en[IPU_CHAN_ID(channel)]) &&
((channel == MEM_PP_MEM) || (channel == MEM_PRP_VF_MEM) ||
(channel == MEM_VDI_PRP_VF_MEM))) {
Out-of-bounds read (OVERRUN)
overrun-local: Overrunning array ipu->thrd_chan_en of 24 bytes at byte offset
25 using index channel >> 24 (which evaluates to 25).
if ((ipu->thrd_chan_en[IPU_CHAN_ID(channel)]) &&
((channel == MEM_PP_MEM) || (channel == MEM_PRP_VF_MEM))) {
thrd_dma = channel_2_dma(channel, IPU_ALPHA_IN_BUFFER);
Signed-off-by: Liu Ying <victor.liu@nxp.com>