From fc093f7b77c396621283ace515ca0361ee38a2e9 Mon Sep 17 00:00:00 2001
From: jeffreym-emt <249819620+jeffreym-emt@users.noreply.github.com>
Date: Wed, 7 Oct 2026 16:26:44 -0500
Subject: [PATCH 1/2] pjmedia-videodev: fix use-after-free crash in
 v4l2_scan_devs()

---
 pjmedia/src/pjmedia-videodev/v4l2_dev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pjmedia/src/pjmedia-videodev/v4l2_dev.c b/pjmedia/src/pjmedia-videodev/v4l2_dev.c
index 9d4a8d55aa..5ab5e2b84d 100644
--- a/pjmedia/src/pjmedia-videodev/v4l2_dev.c
+++ b/pjmedia/src/pjmedia-videodev/v4l2_dev.c
@@ -285,6 +285,7 @@ static pj_status_t v4l2_scan_devs(vid4lin_factory *f)
     if (f->dev_pool) {
         pj_pool_release(f->dev_pool);
         f->dev_pool = NULL;
+        f->dev_info = NULL;
     }
 
     pj_bzero(vdi, sizeof(vdi));
@@ -368,7 +369,7 @@ static pj_status_t v4l2_scan_devs(vid4lin_factory *f)
 
         v4l2_close(fd);
 
-        if (j < fmt_cnt)
+        if (pdi->info.fmt_cnt == 0)
             continue;
 
         f->dev_count++;

From 54b8ef137272ef7a05a2d7a3774a906cb8418cb8 Mon Sep 17 00:00:00 2001
From: jeffreym-emt <249819620+jeffreym-emt@users.noreply.github.com>
Date: Thu, 8 Oct 2026 08:53:04 -0500
Subject: [PATCH 2/2] Clean up old count and always true condition.

---
 pjmedia/src/pjmedia-videodev/v4l2_dev.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/pjmedia/src/pjmedia-videodev/v4l2_dev.c b/pjmedia/src/pjmedia-videodev/v4l2_dev.c
index 5ab5e2b84d..3f7da2b188 100644
--- a/pjmedia/src/pjmedia-videodev/v4l2_dev.c
+++ b/pjmedia/src/pjmedia-videodev/v4l2_dev.c
@@ -279,7 +279,7 @@ static pj_status_t v4l2_scan_devs(vid4lin_factory *f)
 {
     vid4lin_dev_info vdi[V4L2_MAX_DEVS];
     char dev_name[32];
-    unsigned i, old_count;
+    unsigned i;
     pj_status_t status;
 
     if (f->dev_pool) {
@@ -289,7 +289,6 @@ static pj_status_t v4l2_scan_devs(vid4lin_factory *f)
     }
 
     pj_bzero(vdi, sizeof(vdi));
-    old_count = f->dev_count;
     f->dev_count = 0;
     f->dev_pool = pj_pool_create(f->pf, DRIVER_NAME, 500, 500, NULL);
 
@@ -378,12 +377,11 @@ static pj_status_t v4l2_scan_devs(vid4lin_factory *f)
     if (f->dev_count == 0)
         return PJ_SUCCESS;
 
-    if (f->dev_count > old_count || f->dev_info == NULL) {
-        f->dev_info = (vid4lin_dev_info*)
-                      pj_pool_calloc(f->dev_pool,
-                                     f->dev_count,
-                                     sizeof(vid4lin_dev_info));
-    }
+    f->dev_info = (vid4lin_dev_info*)
+                  pj_pool_calloc(f->dev_pool,
+                                 f->dev_count,
+                                 sizeof(vid4lin_dev_info));
+
     pj_memcpy(f->dev_info, vdi, f->dev_count * sizeof(vid4lin_dev_info));
 
     return PJ_SUCCESS;