[PATCH for v4.20] vicodec: fix memchr() kernel oops

[Hans Verkuil]

The size passed to memchr is too large as it assumes the search
starts at the start of the buffer, but it can start at an offset.

Signed-off-by: Hans Verkuil <hans.verk...@cisco.com>
Cc: <sta...@vger.kernel.org>      # for v4.19 and up
---
diff --git a/drivers/media/platform/vicodec/vicodec-core.c 
b/drivers/media/platform/vicodec/vicodec-core.c
index b292cff26c86..013cdebecbc4 100644
--- a/drivers/media/platform/vicodec/vicodec-core.c
+++ b/drivers/media/platform/vicodec/vicodec-core.c
@@ -304,7 +304,8 @@ static int job_ready(void *priv)
                for (; p < p_out + sz; p++) {
                        u32 copy;

-                       p = memchr(p, magic[ctx->comp_magic_cnt], sz);
+                       p = memchr(p, magic[ctx->comp_magic_cnt],
+                                  p_out + sz - p);
                        if (!p) {
                                ctx->comp_magic_cnt = 0;
                                break;