From 739d6bde46f6d7dd68e228f2a27eb039d0550999 Mon Sep 17 00:00:00 2001

From: Kamil Dudka <kdudka@redhat.com>

Date: Thu, 7 Oct 2010 10:56:06 +0200

Subject: [PATCH] libunicap: fix various memory errors

---

 cpi/dcam/dcam_v_modes.c       |    3 ++-

 cpi/euvccam/euvccam_capture.c |    1 +

 cpi/v4l/v4l.c                 |    2 +-

 cpi/v4l2cpi/v4l2.c            |   12 ++++++++++--

 cpi/vid21394/vid21394_cpi.c   |    5 ++---

 src/unicap.c                  |    2 ++

 6 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/cpi/dcam/dcam_v_modes.c b/cpi/dcam/dcam_v_modes.c

index 2b8e45a..05dd318 100644

--- a/cpi/dcam/dcam_v_modes.c

+++ b/cpi/dcam/dcam_v_modes.c

@@ -182,7 +182,8 @@ unicap_status_t _dcam_prepare_format_array( dcam_handle_t dcamhandle,

 		  int index = _dcam_get_mode_index( f, i );

 		  TRACE( "f: %d m: %d  index: %d (%s)\n", f, i, index, _dcam_unicap_formats[index].identifier );

 		  TRACE( "size: %d x %d\n", _dcam_unicap_formats[index].size.width, _dcam_unicap_formats[index].size.height );

-		  memcpy( format_array + current_format, &_dcam_unicap_formats[index], sizeof( unicap_format_t ) );

+		  if( 0 < index )

+		     memcpy( format_array + current_format, &_dcam_unicap_formats[index], sizeof( unicap_format_t ) );

 		  current_format++;

 	       }

 	    }

diff --git a/cpi/euvccam/euvccam_capture.c b/cpi/euvccam/euvccam_capture.c

index 2909bdb..d4ea60e 100644

--- a/cpi/euvccam/euvccam_capture.c

+++ b/cpi/euvccam/euvccam_capture.c

@@ -231,6 +231,7 @@ static void *capture_thread( euvccam_handle_t handle )

       if( ret < 0 ){

 	 TRACE( "Failed to submit urb!\n" );

 	 perror( "ioctl" );

+	 free( urb );

 	 return NULL;

       }

diff --git a/cpi/v4l/v4l.c b/cpi/v4l/v4l.c

index 91b7e87..416dc30 100644

--- a/cpi/v4l/v4l.c

+++ b/cpi/v4l/v4l.c

@@ -292,7 +292,7 @@ static unicap_status_t v4l_open( void **cpi_data, unicap_device_t *device )

 	v4l_handle_t v4lhandle;

 	*cpi_data = malloc( sizeof( struct _v4l_handle ) );

-	if( !cpi_data )

+	if( !*cpi_data )

 	{

 		TRACE( "malloc failed\n" );

 		return STATUS_FAILURE;

diff --git a/cpi/v4l2cpi/v4l2.c b/cpi/v4l2cpi/v4l2.c

index ba3d5b3..925659c 100644

--- a/cpi/v4l2cpi/v4l2.c

+++ b/cpi/v4l2cpi/v4l2.c

@@ -864,7 +864,7 @@ static unicap_status_t v4l2_reenumerate_formats( void *cpi_data, int *_pcount )

       sizes = build_format_size_table( handle, v4l2_fmt.pixelformat, &size_count );

-      if( size_count == 0 )

+      if( sizes == NULL )

       {

 	 handle->unicap_formats[v4l2_fmt.index].min_size.width = 

 	    handle->unicap_formats[v4l2_fmt.index].min_size.height = 1;

@@ -2148,6 +2150,8 @@ static unicap_status_t v4l2_queue_buffer( void *cpi_data, unicap_data_buffer_t *

       else

       {

 	 TRACE( "queue buffer failed\n" );

+	 free( queue );

+	 /* FIXME: should return STATUS_FAILURE? */

       }

       if( ( status == STATUS_NO_BUFFERS ) && ( buffer->type == UNICAP_BUFFER_TYPE_SYSTEM ) )

@@ -2155,6 +2159,10 @@ static unicap_status_t v4l2_queue_buffer( void *cpi_data, unicap_data_buffer_t *

 	 status = STATUS_SUCCESS;

       }

    }

+   else

+   {

+      free( queue );

+   }

    return STATUS_SUCCESS;

diff --git a/cpi/vid21394/vid21394_cpi.c b/cpi/vid21394/vid21394_cpi.c

index c79e8db..e3778e4 100644

--- a/cpi/vid21394/vid21394_cpi.c

+++ b/cpi/vid21394/vid21394_cpi.c

@@ -504,9 +504,6 @@ int cpi_close( void *cpi_data )

 {

    vid21394_data_t *data = cpi_data;

-   vid21394_close( data->vid21394handle );

-

-

    ucutil_destroy_queue( data->in_queue );

    ucutil_destroy_queue( data->out_queue );	

@@ -515,6 +512,8 @@ int cpi_close( void *cpi_data )

       free( data->vid21394handle->unicap_handle );

    }

+   vid21394_close( data->vid21394handle );

+

    g_instance_count--;

    free( data );

diff --git a/src/unicap.c b/src/unicap.c

index 5cfa673..f56c6f0 100644

--- a/src/unicap.c

+++ b/src/unicap.c

@@ -1521,7 +1521,9 @@ unicap_status_t unicap_data_buffer_unref( unicap_data_buffer_t *buffer )

 	 buffer->private->unref_func (buffer, buffer->private->unref_func_data);

       }

       if (buffer->private->ref_count == 0 ){

+	 sem_post (&buffer->private->lock);

 	 unicap_data_buffer_free( buffer );

+	 return STATUS_SUCCESS;

       }

    }else{

       TRACE( "unref of a buffer with refcount <= 0!" );

-- 

1.7.2.3