diff --git a/media/gpu/v4l2/v4l2_image_processor_backend.cc b/media/gpu/v4l2/v4l2_image_processor_backend.cc index 4b79a8c90cb34..10f086044dc79 100644 --- a/media/gpu/v4l2/v4l2_image_processor_backend.cc +++ b/media/gpu/v4l2/v4l2_image_processor_backend.cc @@ -884,6 +884,15 @@ bool V4L2ImageProcessorBackend::EnqueueInputRecord( VideoFrame::PlaneSize(job_record->input_frame->format(), i, input_config_.size) .GetArea(); + // Clamp v4l2_plane.length to the actual span of this frame's plane. + // Without this, .length retains the QUERYBUF value sized from the + // *first* frame's stride, and a later smaller-mapping frame causes + // videobuf2 to pin/DMA-read past the renderer-supplied shmem. + const size_t plane_span = + base::checked_cast(job_record->input_frame->stride(i)) * + VideoFrame::Rows(i, job_record->input_frame->format(), + job_record->input_frame->coded_size().height()); + buffer.SetPlaneSize(i, plane_span); buffer.SetPlaneBytesUsed(i, bytes_used); user_ptrs[i] = const_cast(job_record->input_frame->data(i)); }