Skip to contentSkip to conversation

s5k6aa: off by one in s5k6aa_enum_frame_interval()

PATCH In review Dan Carpenter 3 participants 4 messages Aug 23, 2013

Subsystems (3)
Media (V4L/DVB) Kernel janitors V4L2 camera sensor drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 s5k6aa: off by one in s5k6aa_enum_frame_interval()

The check is off by one so we could read one space past the end of the array.

Signed-off-by Dan Carpenter <[email protected]>
drivers/media/i2c/s5k6aa.c +1 -1
index 789c02a..629a5cd 100644
@@ -1003,7 +1003,7 @@ static int s5k6aa_enum_frame_interval(struct v4l2_subdev *sd,
 	const struct s5k6aa_interval *fi;
 	int ret = 0;
 
-	if (fie->index > ARRAY_SIZE(s5k6aa_intervals))
+	if (fie->index >= ARRAY_SIZE(s5k6aa_intervals))
 		return -EINVAL;
 
 	v4l_bound_align_image(&fie->width, S5K6AA_WIN_WIDTH_MIN,
Acked-by on v1 1/1
#1 lore raw

Hi Dan,

Thank you for the patch.

Quoted 4 lines · On Friday 23 August 2013 12:33:06 Dan Carpenter wrote:

The check is off by one so we could read one space past the end of the array.

Signed-off-by Dan Carpenter <[email protected]>
Acked-by Laurent Pinchart <[email protected]>

Mauro, I have no other pending sensor patches, can you pick this one up from the list, or should I send you a pull request ?

Quoted 13 lines
drivers/media/i2c/s5k6aa.c +1 -1
index 789c02a..629a5cd 100644
@@ -1003,7 +1003,7 @@ static int s5k6aa_enum_frame_interval(struct
 v4l2_subdev *sd, const struct s5k6aa_interval *fi;
 	int ret = 0;
 
-	if (fie->index > ARRAY_SIZE(s5k6aa_intervals))
+	if (fie->index >= ARRAY_SIZE(s5k6aa_intervals))
 		return -EINVAL;
 
 	v4l_bound_align_image(&fie->width, S5K6AA_WIN_WIDTH_MIN,
Signature · 3 lines
Regards,

Laurent Pinchart
#2 lore raw

Hi Laurent,

Quoted 8 lines · Laurent Pinchart

Hi Dan,

Thank you for the patch.

Quoted 3 lines · On Friday 23 August 2013 12:33:06 Dan Carpenter wrote:

The check is off by one so we could read one space past the end of the array.

Quoted 6 lines
Quoted 1 line
Signed-off-by Dan Carpenter <[email protected]>
Acked-by Laurent Pinchart <[email protected]>

Mauro, I have no other pending sensor patches, can you pick this one up from the list, or should I send you a pull request ?

I can handle all pending patches for the Samsung sensors, I was planning to send a pull request today. I can pick up the ov9650 patch as well. I'd like to also include the s5k5bafx sensor patch in one of my pull requests.

IIRC it was agreed that we as Samsung will handle our stuff ourselves and be sending it to Mauro directly.

--
Thanks,
Sylwester

#3 lore raw

Hi Sylwester,

Quoted 12 lines · On Friday 23 August 2013 15:11:49 Sylwester Nawrocki wrote:
Quoted 10 lines · Laurent Pinchart
Quoted 4 lines · On Friday 23 August 2013 12:33:06 Dan Carpenter wrote:

The check is off by one so we could read one space past the end of the array.

Signed-off-by Dan Carpenter <[email protected]>
Acked-by Laurent Pinchart <[email protected]>

Mauro, I have no other pending sensor patches, can you pick this one up from the list, or should I send you a pull request ?

Quoted 7 lines

I can handle all pending patches for the Samsung sensors, I was planning to send a pull request today. I can pick up the ov9650 patch as well. I'd like to also include the s5k5bafx sensor patch in one of my pull requests.

IIRC it was agreed that we as Samsung will handle our stuff ourselves and be sending it to Mauro directly.

That's less work for me, so I will definitely not complain :-)

Signature · 3 lines
Regards,

Laurent Pinchart