diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-01-25 09:15:25 -0500 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2018-03-06 08:20:22 -0500 |
| commit | bd0b5a35aac5315cf4f6d296dee2f23fb28b827d (patch) | |
| tree | 5e5b222349316099f0f9ce1d9c6baf552f64a5f7 /drivers/media/i2c | |
| parent | 8f0aa38292f212a74cb37026d160d946602e76f2 (diff) | |
media: sr030pc30: prevent array underflow in try_fmt()
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/i2c')
| -rw-r--r-- | drivers/media/i2c/sr030pc30.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/media/i2c/sr030pc30.c b/drivers/media/i2c/sr030pc30.c index 0bf031b7e4fa..2a4882cddc51 100644 --- a/drivers/media/i2c/sr030pc30.c +++ b/drivers/media/i2c/sr030pc30.c @@ -511,13 +511,16 @@ static int sr030pc30_get_fmt(struct v4l2_subdev *sd, static const struct sr030pc30_format *try_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) { - int i = ARRAY_SIZE(sr030pc30_formats); + int i; sr030pc30_try_frame_size(mf); - while (i--) + for (i = 0; i < ARRAY_SIZE(sr030pc30_formats); i++) { if (mf->code == sr030pc30_formats[i].code) break; + } + if (i == ARRAY_SIZE(sr030pc30_formats)) + i = 0; mf->code = sr030pc30_formats[i].code; |