s5c73m3: Fix off-by-one valid range checking for fie->index

PATCH In review Axel Lin 2 participants 2 messages Apr 30, 2013

Subsystems (2)

Media (V4L/DVB) Samsung S5C73M3 camera driver

lore

Share & tools

lore

Axel Lin

author

2013-04-30 04:42 UTC #0 lore raw

PATCH 1/1 s5c73m3: Fix off-by-one valid range checking for fie->index

Current code uses fie->index as array subscript, thus the valid value range is 0 ... ARRAY_SIZE(s5c73m3_intervals) - 1.

Signed-off-by Axel Lin <[email protected]>

---
 drivers/media/i2c/s5c73m3/s5c73m3-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/media/i2c/s5c73m3/s5c73m3-core.c +1 -1

index b353c50..cd365bb 100644
@@ -956,7 +956,7 @@ static int s5c73m3_oif_enum_frame_interval(struct v4l2_subdev *sd,
 
 	if (fie->pad != OIF_SOURCE_PAD)
 		return -EINVAL;
-	if (fie->index > ARRAY_SIZE(s5c73m3_intervals))
+	if (fie->index >= ARRAY_SIZE(s5c73m3_intervals))
 		return -EINVAL;
 
 	mutex_lock(&state->lock);

Signature · 1 line

1.8.1.2

Andrzej Hajda

Acked-by on v1 1/1

2013-04-30 08:46 UTC #1 lore raw

Hi Axel,

Thanks for the fix.

Quoted 4 lines · Axel Lin

Current code uses fie->index as array subscript, thus the valid value range is 0 ... ARRAY_SIZE(s5c73m3_intervals) - 1.
Signed-off-by Axel Lin <[email protected]>

Acked-by Andrzej Hajda <[email protected]>

Quoted 17 lines

---
  drivers/media/i2c/s5c73m3/s5c73m3-core.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

drivers/media/i2c/s5c73m3/s5c73m3-core.c +1 -1

index b353c50..cd365bb 100644
@@ -956,7 +956,7 @@ static int s5c73m3_oif_enum_frame_interval(struct v4l2_subdev *sd,
 
  	if (fie->pad != OIF_SOURCE_PAD)
  		return -EINVAL;
-	if (fie->index > ARRAY_SIZE(s5c73m3_intervals))
+	if (fie->index >= ARRAY_SIZE(s5c73m3_intervals))
  		return -EINVAL;
 
  	mutex_lock(&state->lock);