diff --git a/[refs] b/[refs] index 893d5d0377ea..a3f250b9e1d5 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 67e13e7709736b3b25dda98f92cc7164b210dda6 +refs/heads/master: 124371e33ce733a81fde8419946adb0d6c14f4c0 diff --git a/trunk/drivers/media/video/sn9c102/sn9c102_core.c b/trunk/drivers/media/video/sn9c102/sn9c102_core.c index cbf8087b286f..28e19daadec9 100644 --- a/trunk/drivers/media/video/sn9c102/sn9c102_core.c +++ b/trunk/drivers/media/video/sn9c102/sn9c102_core.c @@ -2295,7 +2295,7 @@ sn9c102_vidioc_s_ctrl(struct sn9c102_device* cam, void __user * arg) if (copy_from_user(&ctrl, arg, sizeof(ctrl))) return -EFAULT; - for (i = 0; i < ARRAY_SIZE(s->qctrl); i++) + for (i = 0; i < ARRAY_SIZE(s->qctrl); i++) { if (ctrl.id == s->qctrl[i].id) { if (s->qctrl[i].flags & V4L2_CTRL_FLAG_DISABLED) return -EINVAL; @@ -2305,7 +2305,9 @@ sn9c102_vidioc_s_ctrl(struct sn9c102_device* cam, void __user * arg) ctrl.value -= ctrl.value % s->qctrl[i].step; break; } - + } + if (i == ARRAY_SIZE(s->qctrl)) + return -EINVAL; if ((err = s->set_ctrl(cam, &ctrl))) return err;