From b3a0ebdeee855de7386356e26c870469e6ca3935 Mon Sep 17 00:00:00 2001
From: Vaibhav Hiremath <hvaibhav@ti.com>
Date: Thu, 14 Apr 2011 13:42:34 -0300
Subject: [PATCH] --- yaml --- r: 254640 b: refs/heads/master c:
 383e4f69879d11c86ebdd38b3356f6d0690fb4cc h: refs/heads/master v: v3

---
 [refs]                                     |  2 +-
 trunk/drivers/media/video/omap/omap_vout.c | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index ad8c113fb7f7..2430930fe50f 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8f3a307b9afd8c2ebde46ef317df4df3813301a7
+refs/heads/master: 383e4f69879d11c86ebdd38b3356f6d0690fb4cc
diff --git a/trunk/drivers/media/video/omap/omap_vout.c b/trunk/drivers/media/video/omap/omap_vout.c
index eb16607358d0..4d07c5844402 100644
--- a/trunk/drivers/media/video/omap/omap_vout.c
+++ b/trunk/drivers/media/video/omap/omap_vout.c
@@ -982,6 +982,14 @@ static int omap_vout_buffer_setup(struct videobuf_queue *q, unsigned int *count,
 	startindex = (vout->vid == OMAP_VIDEO1) ?
 		video1_numbuffers : video2_numbuffers;
 
+	/* Check the size of the buffer */
+	if (*size > vout->buffer_size) {
+		v4l2_err(&vout->vid_dev->v4l2_dev,
+				"buffer allocation mismatch [%u] [%u]\n",
+				*size, vout->buffer_size);
+		return -ENOMEM;
+	}
+
 	for (i = startindex; i < *count; i++) {
 		vout->buffer_size = *size;
 
@@ -1228,6 +1236,14 @@ static int omap_vout_mmap(struct file *file, struct vm_area_struct *vma)
 				(vma->vm_pgoff << PAGE_SHIFT));
 		return -EINVAL;
 	}
+	/* Check the size of the buffer */
+	if (size > vout->buffer_size) {
+		v4l2_err(&vout->vid_dev->v4l2_dev,
+				"insufficient memory [%lu] [%u]\n",
+				size, vout->buffer_size);
+		return -ENOMEM;
+	}
+
 	q->bufs[i]->baddr = vma->vm_start;
 
 	vma->vm_flags |= VM_RESERVED;