Commit d22f726a authored by Mikhail Karpenko's avatar Mikhail Karpenko

Fix possible buffer rollover

parent d7776315
......@@ -286,14 +286,14 @@ unsigned long get_image_length(int byte_offset, unsigned int chn, int *last_chun
// if (last_image_chunk < 0)
// last_image_chunk += CCAM_DMA_SIZE;
// len32 = circbuf_priv[chn].buf_ptr[BYTE2DW(last_image_chunk + (CHUNK_SIZE - CCAM_MMAP_META_LENGTH))];
offset = last_image_chunk + (CHUNK_SIZE - CCAM_MMAP_META_LENGTH);
offset = X393_BUFFADD(last_image_chunk, CHUNK_SIZE - CCAM_MMAP_META_LENGTH);
len32 = circbuf_priv[chn].buf_ptr[BYTE2DW(offset)];
if ((len32 & MARKER_FF) != MARKER_FF) {
dev_dbg(g_dev_ptr, "failed to get 0xff marker at offset 0x%x\n", offset);
byte_offset = X393_BUFFSUB(byte_offset, 0x20);
last_image_chunk = X393_BUFFSUB(byte_offset, OFFSET_X40);
offset = last_image_chunk + (CHUNK_SIZE - CCAM_MMAP_META_LENGTH);
offset = X393_BUFFADD(last_image_chunk, CHUNK_SIZE - CCAM_MMAP_META_LENGTH);
len32 = circbuf_priv[chn].buf_ptr[BYTE2DW(offset)];
if ((len32 & MARKER_FF) != MARKER_FF) {
dev_dbg(g_dev_ptr, "failed to get 0xff marker at CORRECTED offset 0x%x\n", offset);
......@@ -301,7 +301,7 @@ unsigned long get_image_length(int byte_offset, unsigned int chn, int *last_chun
}
}
dev_dbg(g_dev_ptr, "got len32 = 0x%lx at 0x%x\n", len32, last_image_chunk + (CHUNK_SIZE - CCAM_MMAP_META_LENGTH));
dev_dbg(g_dev_ptr, "got len32 = 0x%lx at 0x%x\n", len32, offset);
if (last_chunk_offset != NULL)
*last_chunk_offset = last_image_chunk;
......@@ -353,7 +353,7 @@ int circbuf_valid_ptr(int *rp_offset, struct interframe_params_t **fpp, unsigned
} else {
dev_dbg(g_dev_ptr, "interframe pointer and file ponter is advanced by 0x20\n");
*fpp = fp_off;
*rp_offset += CHUNK_SIZE;
*rp_offset = X393_BUFFADD(*rp_offset, CHUNK_SIZE);
dump_interframe_params(fp_off, rp);
return 2;
}
......
......@@ -356,7 +356,7 @@ inline struct interframe_params_t* updateIRQ_interframe(struct jpeg_ptr_t *jptr)
int prev_len32 = circbuf_priv_ptr[jptr->chn_num].buf_ptr[BYTE2DW(prev_len32_off)];
if ((prev_len32 & MARKER_FF) != MARKER_FF) {
printk(KERN_DEBUG "warning: applying offset\n");
prev_len32_off -= 0x20;
prev_len32_off = X393_BUFFSUB(prev_len32_off, 0x20);
prev_len32 = circbuf_priv_ptr[jptr->chn_num].buf_ptr[BYTE2DW(prev_len32_off)];
if ((prev_len32 & MARKER_FF) == MARKER_FF) {
frame_params_offset = BYTE2DW(X393_BUFFADD(prev_len32_off, 4));
......@@ -381,12 +381,12 @@ inline struct interframe_params_t* updateIRQ_interframe(struct jpeg_ptr_t *jptr)
virt_addr = interframe;
__cpuc_flush_dcache_area(virt_addr, CHUNK_SIZE);
outer_inv_range(phys_addr, phys_addr + (CHUNK_SIZE - 1));
if (jptr->chn_num == 0) {
printk(KERN_DEBUG "this channel start address: phys_addr = 0x%x; buf_ptr = 0x%x",
circbuf_priv_ptr[jptr->chn_num].phys_addr, circbuf_priv_ptr[jptr->chn_num].buf_ptr);
printk(KERN_DEBUG "invalidate cache for channel %d: phys_addr = 0x%x; virt_addr = 0x%x\n",
jptr->chn_num, phys_addr, virt_addr);
}
// if (jptr->chn_num == 0) {
// printk(KERN_DEBUG "this channel start address: phys_addr = 0x%x; buf_ptr = 0x%x",
// circbuf_priv_ptr[jptr->chn_num].phys_addr, circbuf_priv_ptr[jptr->chn_num].buf_ptr);
// printk(KERN_DEBUG "invalidate cache for channel %d: phys_addr = 0x%x; virt_addr = 0x%x\n",
// jptr->chn_num, phys_addr, virt_addr);
// }
return interframe;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment