Hello everyone,

I think I brought up this issue before but didn't resolve it completely. Now I'd like to double check this and if we can agree on it, I'd also like to submit a patch to fix it. The problem is that function `get_queue_ctx` can never return a NULL pointer unless pointer overflow occurs, which is very unlikely. To be more specific,

```
static struct v4l2_m2m_queue_ctx *get_queue_ctx(struct v4l2_m2m_ctx *m2m_ctx,
                                                enum v4l2_buf_type type)
{
        if (V4L2_TYPE_IS_OUTPUT(type))
                return &m2m_ctx->out_q_ctx;
        else
                return &m2m_ctx->cap_q_ctx;
}
```

The address returned by this function is either `(char*)m2m_ctx+968` or `(char*)m2m_ctx+16`, so for it to be NULL, `m2m_ctx` must be a large unsigned value. Yet the return value of this function is NULL-checked, for example in v4l2_m2m_get_vq.

Please let me know if it makes sense.

Best,
Shaobo

Reply via email to