From 739d6bde46f6d7dd68e228f2a27eb039d0550999 Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Thu, 7 Oct 2010 10:56:06 +0200 Subject: [PATCH] libunicap: fix various memory errors --- cpi/dcam/dcam_v_modes.c | 3 ++- cpi/euvccam/euvccam_capture.c | 1 + cpi/v4l/v4l.c | 2 +- cpi/v4l2cpi/v4l2.c | 12 ++++++++++-- cpi/vid21394/vid21394_cpi.c | 5 ++--- src/unicap.c | 2 ++ 6 files changed, 18 insertions(+), 7 deletions(-) diff --git a/cpi/dcam/dcam_v_modes.c b/cpi/dcam/dcam_v_modes.c index 2b8e45a..05dd318 100644 --- a/cpi/dcam/dcam_v_modes.c +++ b/cpi/dcam/dcam_v_modes.c @@ -182,7 +182,8 @@ unicap_status_t _dcam_prepare_format_array( dcam_handle_t dcamhandle, int index = _dcam_get_mode_index( f, i ); TRACE( "f: %d m: %d index: %d (%s)\n", f, i, index, _dcam_unicap_formats[index].identifier ); TRACE( "size: %d x %d\n", _dcam_unicap_formats[index].size.width, _dcam_unicap_formats[index].size.height ); - memcpy( format_array + current_format, &_dcam_unicap_formats[index], sizeof( unicap_format_t ) ); + if( 0 < index ) + memcpy( format_array + current_format, &_dcam_unicap_formats[index], sizeof( unicap_format_t ) ); current_format++; } } diff --git a/cpi/euvccam/euvccam_capture.c b/cpi/euvccam/euvccam_capture.c index 2909bdb..d4ea60e 100644 --- a/cpi/euvccam/euvccam_capture.c +++ b/cpi/euvccam/euvccam_capture.c @@ -231,6 +231,7 @@ static void *capture_thread( euvccam_handle_t handle ) if( ret < 0 ){ TRACE( "Failed to submit urb!\n" ); perror( "ioctl" ); + free( urb ); return NULL; } diff --git a/cpi/v4l/v4l.c b/cpi/v4l/v4l.c index 91b7e87..416dc30 100644 --- a/cpi/v4l/v4l.c +++ b/cpi/v4l/v4l.c @@ -292,7 +292,7 @@ static unicap_status_t v4l_open( void **cpi_data, unicap_device_t *device ) v4l_handle_t v4lhandle; *cpi_data = malloc( sizeof( struct _v4l_handle ) ); - if( !cpi_data ) + if( !*cpi_data ) { TRACE( "malloc failed\n" ); return STATUS_FAILURE; diff --git a/cpi/v4l2cpi/v4l2.c b/cpi/v4l2cpi/v4l2.c index ba3d5b3..925659c 100644 --- a/cpi/v4l2cpi/v4l2.c +++ b/cpi/v4l2cpi/v4l2.c @@ -864,7 +864,7 @@ static unicap_status_t v4l2_reenumerate_formats( void *cpi_data, int *_pcount ) sizes = build_format_size_table( handle, v4l2_fmt.pixelformat, &size_count ); - if( size_count == 0 ) + if( sizes == NULL ) { handle->unicap_formats[v4l2_fmt.index].min_size.width = handle->unicap_formats[v4l2_fmt.index].min_size.height = 1; @@ -2148,6 +2150,8 @@ static unicap_status_t v4l2_queue_buffer( void *cpi_data, unicap_data_buffer_t * else { TRACE( "queue buffer failed\n" ); + free( queue ); + /* FIXME: should return STATUS_FAILURE? */ } if( ( status == STATUS_NO_BUFFERS ) && ( buffer->type == UNICAP_BUFFER_TYPE_SYSTEM ) ) @@ -2155,6 +2159,10 @@ static unicap_status_t v4l2_queue_buffer( void *cpi_data, unicap_data_buffer_t * status = STATUS_SUCCESS; } } + else + { + free( queue ); + } return STATUS_SUCCESS; diff --git a/cpi/vid21394/vid21394_cpi.c b/cpi/vid21394/vid21394_cpi.c index c79e8db..e3778e4 100644 --- a/cpi/vid21394/vid21394_cpi.c +++ b/cpi/vid21394/vid21394_cpi.c @@ -504,9 +504,6 @@ int cpi_close( void *cpi_data ) { vid21394_data_t *data = cpi_data; - vid21394_close( data->vid21394handle ); - - ucutil_destroy_queue( data->in_queue ); ucutil_destroy_queue( data->out_queue ); @@ -515,6 +512,8 @@ int cpi_close( void *cpi_data ) free( data->vid21394handle->unicap_handle ); } + vid21394_close( data->vid21394handle ); + g_instance_count--; free( data ); diff --git a/src/unicap.c b/src/unicap.c index 5cfa673..f56c6f0 100644 --- a/src/unicap.c +++ b/src/unicap.c @@ -1521,7 +1521,9 @@ unicap_status_t unicap_data_buffer_unref( unicap_data_buffer_t *buffer ) buffer->private->unref_func (buffer, buffer->private->unref_func_data); } if (buffer->private->ref_count == 0 ){ + sem_post (&buffer->private->lock); unicap_data_buffer_free( buffer ); + return STATUS_SUCCESS; } }else{ TRACE( "unref of a buffer with refcount <= 0!" ); -- 1.7.2.3