[PATCH] [media] uvcvideo: Check format and frame size in VIDIOC_CREATE_BUFS

[Philipp Zabel]

Verify that create_bufs requests buffers with the currently selected
format and frame size, return an error otherwise.

Signed-off-by: Philipp Zabel <p.za...@pengutronix.de>
---
 drivers/media/usb/uvc/uvc_v4l2.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 2cea127..fae61a2 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -1003,10 +1003,24 @@ static long uvc_v4l2_do_ioctl(struct file *file, 
unsigned int cmd, void *arg)
        case VIDIOC_CREATE_BUFS:
        {
                struct v4l2_create_buffers *cb = arg;
+               struct v4l2_pix_format *pix;
+               struct uvc_format *format;
+               struct uvc_frame *frame;
 
                if (!uvc_has_privileges(handle))
                        return -EBUSY;
 
+               format = stream->cur_format;
+               frame = stream->cur_frame;
+               pix = &cb->format.fmt.pix;
+
+               if (pix->pixelformat != format->fcc ||
+                   pix->width != frame->wWidth ||
+                   pix->height != frame->wHeight ||
+                   pix->bytesperline != format->bpp * frame->wWidth / 8 ||
+                   pix->sizeimage != stream->ctrl.dwMaxVideoFrameSize)
+                       return -EINVAL;
+
                return uvc_create_buffers(&stream->queue, cb);
        }
 
-- 
1.8.5.3

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html