| From foo@baz Fri Mar 16 15:43:17 CET 2018 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Thu, 9 Nov 2017 16:28:14 -0500 |
| Subject: media: cpia2: Fix a couple off by one bugs |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| |
| [ Upstream commit d5ac225c7d64c9c3ef821239edc035634e594ec9 ] |
| |
| The cam->buffers[] array has cam->num_frames elements so the > needs to |
| be changed to >= to avoid going beyond the end of the array. The |
| ->buffers[] array is allocated in cpia2_allocate_buffers() if you want |
| to confirm. |
| |
| Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support") |
| |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/media/usb/cpia2/cpia2_v4l.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/media/usb/cpia2/cpia2_v4l.c |
| +++ b/drivers/media/usb/cpia2/cpia2_v4l.c |
| @@ -808,7 +808,7 @@ static int cpia2_querybuf(struct file *f |
| struct camera_data *cam = video_drvdata(file); |
| |
| if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || |
| - buf->index > cam->num_frames) |
| + buf->index >= cam->num_frames) |
| return -EINVAL; |
| |
| buf->m.offset = cam->buffers[buf->index].data - cam->frame_buffer; |
| @@ -859,7 +859,7 @@ static int cpia2_qbuf(struct file *file, |
| |
| if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || |
| buf->memory != V4L2_MEMORY_MMAP || |
| - buf->index > cam->num_frames) |
| + buf->index >= cam->num_frames) |
| return -EINVAL; |
| |
| DBG("QBUF #%d\n", buf->index); |
