When vivid_update_format_cap() is called it should free any overlay
bitmap since the compose size will change.
Signed-off-by: Hans Verkuil <hverk...@xs4all.nl>
Reported-by: syzbot+0cc8e3cc63ca37372...@syzkaller.appspotmail.com
---
drivers/media/platform/vivid/vivid-vid-cap.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c
b/drivers/media/platform/vivid/vivid-vid-cap.c
index 9c8e8be81ce3..46d4e53ce763 100644
--- a/drivers/media/platform/vivid/vivid-vid-cap.c
+++ b/drivers/media/platform/vivid/vivid-vid-cap.c
@@ -451,6 +451,8 @@ void vivid_update_format_cap(struct vivid_dev *dev, bool
keep_controls)
tpg_s_rgb_range(&dev->tpg,
v4l2_ctrl_g_ctrl(dev->rgb_range_cap));
break;
}
+ vfree(dev->bitmap_cap);
+ dev->bitmap_cap = NULL;
vivid_update_quality(dev);
tpg_reset_source(&dev->tpg, dev->src_rect.width, dev->src_rect.height,
dev->field_cap);
dev->crop_cap = dev->src_rect;
--
2.19.1
