video/au0828: off by one bug

PATCH New Dan Carpenter 1 participant 1 message Mar 28, 2010

Subsystems (2)

Media (V4L/DVB) Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2010-03-28 11:21 UTC #0 lore raw

PATCH 1/1 video/au0828: off by one bug

The "AUVI_INPUT(tmp)" macro uses "tmp" as an index of an array with AU0828_MAX_INPUT elements.

Signed-off-by Dan Carpenter <[email protected]>

drivers/media/video/au0828/au0828-video.c +1 -1

index dc67bc4..19a5773 100644
@@ -1104,7 +1104,7 @@ static int vidioc_enum_input(struct file *file, void *priv,
 
 	tmp = input->index;
 
-	if (tmp > AU0828_MAX_INPUT)
+	if (tmp >= AU0828_MAX_INPUT)
 		return -EINVAL;
 	if (AUVI_INPUT(tmp).type = 0)
 		return -EINVAL;