Skip to contentSkip to conversation

V4L/DVB: keep index within bound in vpfe_cropcap()

PATCH In review Roel Kluin 2 participants 2 messages Oct 26, 2009 Media (V4L/DVB)

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 V4L/DVB: keep index within bound in vpfe_cropcap()

If vpfe_dev->std_index equals ARRAY_SIZE(vpfe_standards), that is one too large

Signed-off-by Roel Kluin <[email protected]>
---
 drivers/media/video/davinci/vpfe_capture.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
drivers/media/video/davinci/vpfe_capture.c +1 -1
index 402ce43..6b31e59 100644
@@ -1577,7 +1577,7 @@ static int vpfe_cropcap(struct file *file, void *priv,
 
 	v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, "vpfe_cropcap\n");
 
-	if (vpfe_dev->std_index > ARRAY_SIZE(vpfe_standards))
+	if (vpfe_dev->std_index >= ARRAY_SIZE(vpfe_standards))
 		return -EINVAL;
 
 	memset(crop, 0, sizeof(struct v4l2_cropcap));
#1 lore raw

Roel,

Thanks for fixing this.

Mauro,

Could you merge this please?

Acked-by Muralidharan Karicheri <[email protected]>

Murali Karicheri
Software Design Engineer
Texas Instruments Inc.
Germantown, MD 20874
phone: 301-407-9583
email: [email protected]

Quoted 29 lines

-----Original Message-----
From: Roel Kluin [mailto:[email protected]]
Sent: Monday, October 26, 2009 7:25 AM
To: Mauro Carvalho Chehab; [email protected]; Andrew Morton; Karicheri, Muralidharan
Subject: [PATCH] V4L/DVB: keep index within bound in vpfe_cropcap()

If vpfe_dev->std_index equals ARRAY_SIZE(vpfe_standards), that is one too large

Signed-off-by Roel Kluin <[email protected]>

---
drivers/media/video/davinci/vpfe_capture.c | 2 +-

1 files changed, 1 insertions(+), 1 deletions(-)
drivers/media/video/davinci/vpfe_capture.c +1 -1
index 402ce43..6b31e59 100644
@@ -1577,7 +1577,7 @@ static int vpfe_cropcap(struct file *file, void *priv,
 
 	v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, "vpfe_cropcap\n");
 
-	if (vpfe_dev->std_index > ARRAY_SIZE(vpfe_standards))
+	if (vpfe_dev->std_index >= ARRAY_SIZE(vpfe_standards))
 		return -EINVAL;
 
 	memset(crop, 0, sizeof(struct v4l2_cropcap));