127 lines
4.2 KiB
Diff
127 lines
4.2 KiB
Diff
From 739d6bde46f6d7dd68e228f2a27eb039d0550999 Mon Sep 17 00:00:00 2001
|
|
From: Kamil Dudka <kdudka@redhat.com>
|
|
Date: Thu, 7 Oct 2010 10:56:06 +0200
|
|
Subject: [PATCH] libunicap: fix various memory errors
|
|
|
|
---
|
|
cpi/dcam/dcam_v_modes.c | 3 ++-
|
|
cpi/euvccam/euvccam_capture.c | 1 +
|
|
cpi/v4l/v4l.c | 2 +-
|
|
cpi/v4l2cpi/v4l2.c | 12 ++++++++++--
|
|
cpi/vid21394/vid21394_cpi.c | 5 ++---
|
|
src/unicap.c | 2 ++
|
|
6 files changed, 18 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/cpi/dcam/dcam_v_modes.c b/cpi/dcam/dcam_v_modes.c
|
|
index 2b8e45a..05dd318 100644
|
|
--- a/cpi/dcam/dcam_v_modes.c
|
|
+++ b/cpi/dcam/dcam_v_modes.c
|
|
@@ -182,7 +182,8 @@ unicap_status_t _dcam_prepare_format_array( dcam_handle_t dcamhandle,
|
|
int index = _dcam_get_mode_index( f, i );
|
|
TRACE( "f: %d m: %d index: %d (%s)\n", f, i, index, _dcam_unicap_formats[index].identifier );
|
|
TRACE( "size: %d x %d\n", _dcam_unicap_formats[index].size.width, _dcam_unicap_formats[index].size.height );
|
|
- memcpy( format_array + current_format, &_dcam_unicap_formats[index], sizeof( unicap_format_t ) );
|
|
+ if( 0 < index )
|
|
+ memcpy( format_array + current_format, &_dcam_unicap_formats[index], sizeof( unicap_format_t ) );
|
|
current_format++;
|
|
}
|
|
}
|
|
diff --git a/cpi/euvccam/euvccam_capture.c b/cpi/euvccam/euvccam_capture.c
|
|
index 2909bdb..d4ea60e 100644
|
|
--- a/cpi/euvccam/euvccam_capture.c
|
|
+++ b/cpi/euvccam/euvccam_capture.c
|
|
@@ -231,6 +231,7 @@ static void *capture_thread( euvccam_handle_t handle )
|
|
if( ret < 0 ){
|
|
TRACE( "Failed to submit urb!\n" );
|
|
perror( "ioctl" );
|
|
+ free( urb );
|
|
return NULL;
|
|
}
|
|
|
|
diff --git a/cpi/v4l/v4l.c b/cpi/v4l/v4l.c
|
|
index 91b7e87..416dc30 100644
|
|
--- a/cpi/v4l/v4l.c
|
|
+++ b/cpi/v4l/v4l.c
|
|
@@ -292,7 +292,7 @@ static unicap_status_t v4l_open( void **cpi_data, unicap_device_t *device )
|
|
v4l_handle_t v4lhandle;
|
|
|
|
*cpi_data = malloc( sizeof( struct _v4l_handle ) );
|
|
- if( !cpi_data )
|
|
+ if( !*cpi_data )
|
|
{
|
|
TRACE( "malloc failed\n" );
|
|
return STATUS_FAILURE;
|
|
diff --git a/cpi/v4l2cpi/v4l2.c b/cpi/v4l2cpi/v4l2.c
|
|
index ba3d5b3..925659c 100644
|
|
--- a/cpi/v4l2cpi/v4l2.c
|
|
+++ b/cpi/v4l2cpi/v4l2.c
|
|
@@ -864,7 +864,7 @@ static unicap_status_t v4l2_reenumerate_formats( void *cpi_data, int *_pcount )
|
|
|
|
sizes = build_format_size_table( handle, v4l2_fmt.pixelformat, &size_count );
|
|
|
|
- if( size_count == 0 )
|
|
+ if( sizes == NULL )
|
|
{
|
|
handle->unicap_formats[v4l2_fmt.index].min_size.width =
|
|
handle->unicap_formats[v4l2_fmt.index].min_size.height = 1;
|
|
@@ -2148,6 +2150,8 @@ static unicap_status_t v4l2_queue_buffer( void *cpi_data, unicap_data_buffer_t *
|
|
else
|
|
{
|
|
TRACE( "queue buffer failed\n" );
|
|
+ free( queue );
|
|
+ /* FIXME: should return STATUS_FAILURE? */
|
|
}
|
|
|
|
if( ( status == STATUS_NO_BUFFERS ) && ( buffer->type == UNICAP_BUFFER_TYPE_SYSTEM ) )
|
|
@@ -2155,6 +2159,10 @@ static unicap_status_t v4l2_queue_buffer( void *cpi_data, unicap_data_buffer_t *
|
|
status = STATUS_SUCCESS;
|
|
}
|
|
}
|
|
+ else
|
|
+ {
|
|
+ free( queue );
|
|
+ }
|
|
|
|
|
|
return STATUS_SUCCESS;
|
|
diff --git a/cpi/vid21394/vid21394_cpi.c b/cpi/vid21394/vid21394_cpi.c
|
|
index c79e8db..e3778e4 100644
|
|
--- a/cpi/vid21394/vid21394_cpi.c
|
|
+++ b/cpi/vid21394/vid21394_cpi.c
|
|
@@ -504,9 +504,6 @@ int cpi_close( void *cpi_data )
|
|
{
|
|
vid21394_data_t *data = cpi_data;
|
|
|
|
- vid21394_close( data->vid21394handle );
|
|
-
|
|
-
|
|
ucutil_destroy_queue( data->in_queue );
|
|
ucutil_destroy_queue( data->out_queue );
|
|
|
|
@@ -515,6 +512,8 @@ int cpi_close( void *cpi_data )
|
|
free( data->vid21394handle->unicap_handle );
|
|
}
|
|
|
|
+ vid21394_close( data->vid21394handle );
|
|
+
|
|
g_instance_count--;
|
|
free( data );
|
|
|
|
diff --git a/src/unicap.c b/src/unicap.c
|
|
index 5cfa673..f56c6f0 100644
|
|
--- a/src/unicap.c
|
|
+++ b/src/unicap.c
|
|
@@ -1521,7 +1521,9 @@ unicap_status_t unicap_data_buffer_unref( unicap_data_buffer_t *buffer )
|
|
buffer->private->unref_func (buffer, buffer->private->unref_func_data);
|
|
}
|
|
if (buffer->private->ref_count == 0 ){
|
|
+ sem_post (&buffer->private->lock);
|
|
unicap_data_buffer_free( buffer );
|
|
+ return STATUS_SUCCESS;
|
|
}
|
|
}else{
|
|
TRACE( "unref of a buffer with refcount <= 0!" );
|
|
--
|
|
1.7.2.3
|
|
|