diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2017-05-26 12:28:05 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2017-06-07 12:42:03 -0300 |
| commit | 9dff81436d4d8aa252233bd146d882aaa04094e3 (patch) | |
| tree | f50473d650ba1beed190f5175af20e073f561cc7 /drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c | |
| parent | 94e23b61486c979e92357f9c3a97a277209720ea (diff) | |
[media] atomisp2: off by one in atomisp_s_input()
The isp->inputs[] array has isp->input_cnt elements which have been
initialized so this > should be >=.
This bug is harmless. The check against ATOM_ISP_MAX_INPUTS prevents us
from reading beyond the end of the array. The uninitialized elements
are zeroed out so we will end up returning -EINVAL a few lines later
because the .camera pointer is NULL.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c')
| -rw-r--r-- | drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c index 6064bb823a47..aa0526ebaff1 100644 --- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c +++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c @@ -683,7 +683,7 @@ static int atomisp_s_input(struct file *file, void *fh, unsigned int input) int ret; rt_mutex_lock(&isp->mutex); - if (input >= ATOM_ISP_MAX_INPUTS || input > isp->input_cnt) { + if (input >= ATOM_ISP_MAX_INPUTS || input >= isp->input_cnt) { dev_dbg(isp->dev, "input_cnt: %d\n", isp->input_cnt); ret = -EINVAL; goto error; |