Commit 00a1e133 authored by Jaroslav Beran's avatar Jaroslav Beran Committed by Michael Niedermayer

libavdevice/v4l2: fix invalid access to struct v4l2_buffer

In case we are short of queued buffers, at first v4l2_buffer was enqueued to kernel so it's not owned by
user-space anymore. After that it's timestamp field was read, but it might be overwritten by driver at
that moment. It resulted in invalid timestamp sometimes.
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 5a941553
...@@ -492,6 +492,7 @@ static int mmap_read_frame(AVFormatContext *ctx, AVPacket *pkt) ...@@ -492,6 +492,7 @@ static int mmap_read_frame(AVFormatContext *ctx, AVPacket *pkt)
.type = V4L2_BUF_TYPE_VIDEO_CAPTURE, .type = V4L2_BUF_TYPE_VIDEO_CAPTURE,
.memory = V4L2_MEMORY_MMAP .memory = V4L2_MEMORY_MMAP
}; };
struct timeval buf_ts;
int res; int res;
pkt->size = 0; pkt->size = 0;
...@@ -508,6 +509,8 @@ static int mmap_read_frame(AVFormatContext *ctx, AVPacket *pkt) ...@@ -508,6 +509,8 @@ static int mmap_read_frame(AVFormatContext *ctx, AVPacket *pkt)
return res; return res;
} }
buf_ts = buf.timestamp;
if (buf.index >= s->buffers) { if (buf.index >= s->buffers) {
av_log(ctx, AV_LOG_ERROR, "Invalid buffer index received.\n"); av_log(ctx, AV_LOG_ERROR, "Invalid buffer index received.\n");
return AVERROR(EINVAL); return AVERROR(EINVAL);
...@@ -583,7 +586,7 @@ static int mmap_read_frame(AVFormatContext *ctx, AVPacket *pkt) ...@@ -583,7 +586,7 @@ static int mmap_read_frame(AVFormatContext *ctx, AVPacket *pkt)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
} }
} }
pkt->pts = buf.timestamp.tv_sec * INT64_C(1000000) + buf.timestamp.tv_usec; pkt->pts = buf_ts.tv_sec * INT64_C(1000000) + buf_ts.tv_usec;
convert_timestamp(ctx, &pkt->pts); convert_timestamp(ctx, &pkt->pts);
return pkt->size; return pkt->size;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment