libunicap/libunicap-0.9.12-memerrs.patch

From 739d6bde46f6d7dd68e228f2a27eb039d0550999 Mon Sep 17 00:00:00 2001
From: Kamil Dudka <kdudka@redhat.com>
Date: Thu, 7 Oct 2010 10:56:06 +0200
Subject: [PATCH] libunicap: fix various memory errors

---
 cpi/dcam/dcam_v_modes.c       |    3 ++-
 cpi/euvccam/euvccam_capture.c |    1 +
 cpi/v4l/v4l.c                 |    2 +-
 cpi/v4l2cpi/v4l2.c            |   12 ++++++++++--
 cpi/vid21394/vid21394_cpi.c   |    5 ++---
 src/unicap.c                  |    2 ++
 6 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/cpi/dcam/dcam_v_modes.c b/cpi/dcam/dcam_v_modes.c
index 2b8e45a..05dd318 100644
--- a/cpi/dcam/dcam_v_modes.c
+++ b/cpi/dcam/dcam_v_modes.c
@@ -182,7 +182,8 @@ unicap_status_t _dcam_prepare_format_array( dcam_handle_t dcamhandle,
 		  int index = _dcam_get_mode_index( f, i );
 		  TRACE( "f: %d m: %d  index: %d (%s)\n", f, i, index, _dcam_unicap_formats[index].identifier );
 		  TRACE( "size: %d x %d\n", _dcam_unicap_formats[index].size.width, _dcam_unicap_formats[index].size.height );
-		  memcpy( format_array + current_format, &_dcam_unicap_formats[index], sizeof( unicap_format_t ) );
+		  if( 0 < index )
+		     memcpy( format_array + current_format, &_dcam_unicap_formats[index], sizeof( unicap_format_t ) );
 		  current_format++;
 	       }
 	    }
diff --git a/cpi/euvccam/euvccam_capture.c b/cpi/euvccam/euvccam_capture.c
index 2909bdb..d4ea60e 100644
--- a/cpi/euvccam/euvccam_capture.c
+++ b/cpi/euvccam/euvccam_capture.c
@@ -231,6 +231,7 @@ static void *capture_thread( euvccam_handle_t handle )
       if( ret < 0 ){
 	 TRACE( "Failed to submit urb!\n" );
 	 perror( "ioctl" );
+	 free( urb );
 	 return NULL;
       }
 
diff --git a/cpi/v4l/v4l.c b/cpi/v4l/v4l.c
index 91b7e87..416dc30 100644
--- a/cpi/v4l/v4l.c
+++ b/cpi/v4l/v4l.c
@@ -292,7 +292,7 @@ static unicap_status_t v4l_open( void **cpi_data, unicap_device_t *device )
 	v4l_handle_t v4lhandle;
 	
 	*cpi_data = malloc( sizeof( struct _v4l_handle ) );
-	if( !cpi_data )
+	if( !*cpi_data )
 	{
 		TRACE( "malloc failed\n" );
 		return STATUS_FAILURE;
diff --git a/cpi/v4l2cpi/v4l2.c b/cpi/v4l2cpi/v4l2.c
index ba3d5b3..925659c 100644
--- a/cpi/v4l2cpi/v4l2.c
+++ b/cpi/v4l2cpi/v4l2.c
@@ -864,7 +864,7 @@ static unicap_status_t v4l2_reenumerate_formats( void *cpi_data, int *_pcount )
 
       sizes = build_format_size_table( handle, v4l2_fmt.pixelformat, &size_count );
 		
-      if( size_count == 0 )
+      if( sizes == NULL )
       {
 	 handle->unicap_formats[v4l2_fmt.index].min_size.width = 
 	    handle->unicap_formats[v4l2_fmt.index].min_size.height = 1;
@@ -2148,6 +2150,8 @@ static unicap_status_t v4l2_queue_buffer( void *cpi_data, unicap_data_buffer_t *
       else
       {
 	 TRACE( "queue buffer failed\n" );
+	 free( queue );
+	 /* FIXME: should return STATUS_FAILURE? */
       }
 
       if( ( status == STATUS_NO_BUFFERS ) && ( buffer->type == UNICAP_BUFFER_TYPE_SYSTEM ) )
@@ -2155,6 +2159,10 @@ static unicap_status_t v4l2_queue_buffer( void *cpi_data, unicap_data_buffer_t *
 	 status = STATUS_SUCCESS;
       }
    }
+   else
+   {
+      free( queue );
+   }
 
    
    return STATUS_SUCCESS;
diff --git a/cpi/vid21394/vid21394_cpi.c b/cpi/vid21394/vid21394_cpi.c
index c79e8db..e3778e4 100644
--- a/cpi/vid21394/vid21394_cpi.c
+++ b/cpi/vid21394/vid21394_cpi.c
@@ -504,9 +504,6 @@ int cpi_close( void *cpi_data )
 {
    vid21394_data_t *data = cpi_data;
 
-   vid21394_close( data->vid21394handle );
-
-
    ucutil_destroy_queue( data->in_queue );
    ucutil_destroy_queue( data->out_queue );	
 	
@@ -515,6 +512,8 @@ int cpi_close( void *cpi_data )
       free( data->vid21394handle->unicap_handle );
    }
 
+   vid21394_close( data->vid21394handle );
+
    g_instance_count--;
    free( data );
 	
diff --git a/src/unicap.c b/src/unicap.c
index 5cfa673..f56c6f0 100644
--- a/src/unicap.c
+++ b/src/unicap.c
@@ -1521,7 +1521,9 @@ unicap_status_t unicap_data_buffer_unref( unicap_data_buffer_t *buffer )
 	 buffer->private->unref_func (buffer, buffer->private->unref_func_data);
       }
       if (buffer->private->ref_count == 0 ){
+	 sem_post (&buffer->private->lock);
 	 unicap_data_buffer_free( buffer );
+	 return STATUS_SUCCESS;
       }
    }else{
       TRACE( "unref of a buffer with refcount <= 0!" );
-- 
1.7.2.3