libunicap/libunicap-0.9.12-memerrs.patch

127 lines
4.2 KiB
Diff
Raw Permalink Normal View History

From 739d6bde46f6d7dd68e228f2a27eb039d0550999 Mon Sep 17 00:00:00 2001
From: Kamil Dudka <kdudka@redhat.com>
Date: Thu, 7 Oct 2010 10:56:06 +0200
Subject: [PATCH] libunicap: fix various memory errors
---
cpi/dcam/dcam_v_modes.c | 3 ++-
cpi/euvccam/euvccam_capture.c | 1 +
cpi/v4l/v4l.c | 2 +-
cpi/v4l2cpi/v4l2.c | 12 ++++++++++--
cpi/vid21394/vid21394_cpi.c | 5 ++---
src/unicap.c | 2 ++
6 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/cpi/dcam/dcam_v_modes.c b/cpi/dcam/dcam_v_modes.c
index 2b8e45a..05dd318 100644
--- a/cpi/dcam/dcam_v_modes.c
+++ b/cpi/dcam/dcam_v_modes.c
@@ -182,7 +182,8 @@ unicap_status_t _dcam_prepare_format_array( dcam_handle_t dcamhandle,
int index = _dcam_get_mode_index( f, i );
TRACE( "f: %d m: %d index: %d (%s)\n", f, i, index, _dcam_unicap_formats[index].identifier );
TRACE( "size: %d x %d\n", _dcam_unicap_formats[index].size.width, _dcam_unicap_formats[index].size.height );
- memcpy( format_array + current_format, &_dcam_unicap_formats[index], sizeof( unicap_format_t ) );
+ if( 0 < index )
+ memcpy( format_array + current_format, &_dcam_unicap_formats[index], sizeof( unicap_format_t ) );
current_format++;
}
}
diff --git a/cpi/euvccam/euvccam_capture.c b/cpi/euvccam/euvccam_capture.c
index 2909bdb..d4ea60e 100644
--- a/cpi/euvccam/euvccam_capture.c
+++ b/cpi/euvccam/euvccam_capture.c
@@ -231,6 +231,7 @@ static void *capture_thread( euvccam_handle_t handle )
if( ret < 0 ){
TRACE( "Failed to submit urb!\n" );
perror( "ioctl" );
+ free( urb );
return NULL;
}
diff --git a/cpi/v4l/v4l.c b/cpi/v4l/v4l.c
index 91b7e87..416dc30 100644
--- a/cpi/v4l/v4l.c
+++ b/cpi/v4l/v4l.c
@@ -292,7 +292,7 @@ static unicap_status_t v4l_open( void **cpi_data, unicap_device_t *device )
v4l_handle_t v4lhandle;
*cpi_data = malloc( sizeof( struct _v4l_handle ) );
- if( !cpi_data )
+ if( !*cpi_data )
{
TRACE( "malloc failed\n" );
return STATUS_FAILURE;
diff --git a/cpi/v4l2cpi/v4l2.c b/cpi/v4l2cpi/v4l2.c
index ba3d5b3..925659c 100644
--- a/cpi/v4l2cpi/v4l2.c
+++ b/cpi/v4l2cpi/v4l2.c
@@ -864,7 +864,7 @@ static unicap_status_t v4l2_reenumerate_formats( void *cpi_data, int *_pcount )
sizes = build_format_size_table( handle, v4l2_fmt.pixelformat, &size_count );
- if( size_count == 0 )
+ if( sizes == NULL )
{
handle->unicap_formats[v4l2_fmt.index].min_size.width =
handle->unicap_formats[v4l2_fmt.index].min_size.height = 1;
@@ -2148,6 +2150,8 @@ static unicap_status_t v4l2_queue_buffer( void *cpi_data, unicap_data_buffer_t *
else
{
TRACE( "queue buffer failed\n" );
+ free( queue );
+ /* FIXME: should return STATUS_FAILURE? */
}
if( ( status == STATUS_NO_BUFFERS ) && ( buffer->type == UNICAP_BUFFER_TYPE_SYSTEM ) )
@@ -2155,6 +2159,10 @@ static unicap_status_t v4l2_queue_buffer( void *cpi_data, unicap_data_buffer_t *
status = STATUS_SUCCESS;
}
}
+ else
+ {
+ free( queue );
+ }
return STATUS_SUCCESS;
diff --git a/cpi/vid21394/vid21394_cpi.c b/cpi/vid21394/vid21394_cpi.c
index c79e8db..e3778e4 100644
--- a/cpi/vid21394/vid21394_cpi.c
+++ b/cpi/vid21394/vid21394_cpi.c
@@ -504,9 +504,6 @@ int cpi_close( void *cpi_data )
{
vid21394_data_t *data = cpi_data;
- vid21394_close( data->vid21394handle );
-
-
ucutil_destroy_queue( data->in_queue );
ucutil_destroy_queue( data->out_queue );
@@ -515,6 +512,8 @@ int cpi_close( void *cpi_data )
free( data->vid21394handle->unicap_handle );
}
+ vid21394_close( data->vid21394handle );
+
g_instance_count--;
free( data );
diff --git a/src/unicap.c b/src/unicap.c
index 5cfa673..f56c6f0 100644
--- a/src/unicap.c
+++ b/src/unicap.c
@@ -1521,7 +1521,9 @@ unicap_status_t unicap_data_buffer_unref( unicap_data_buffer_t *buffer )
buffer->private->unref_func (buffer, buffer->private->unref_func_data);
}
if (buffer->private->ref_count == 0 ){
+ sem_post (&buffer->private->lock);
unicap_data_buffer_free( buffer );
+ return STATUS_SUCCESS;
}
}else{
TRACE( "unref of a buffer with refcount <= 0!" );
--
1.7.2.3