Skip to content

Commit

Permalink
media: atomisp2: Array underflow in atomisp_enum_input()
Browse files Browse the repository at this point in the history
The problem here is this code from atomisp_enum_input():

   581          int index = input->index;
   582
   583          if (index >= isp->input_cnt)
   584                  return -EINVAL;
   585
   586          if (!isp->inputs[index].camera)
   587                  return -EINVAL;

"input->index" is a u32 which comes from the ioctl.  We want negative
values of "index" to be counted as -EINVAL but they aren't.  I've fixed
this by changing the type of "isp->input_cnt" to unsigned int.

Fixes: a49d253 ("staging/atomisp: Add support for the Intel IPU v2")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
  • Loading branch information
Dan Carpenter authored and Mauro Carvalho Chehab committed Jul 26, 2017
1 parent b25db38 commit 7b065c5
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
@@ -275,7 +275,7 @@ struct atomisp_device {
*/
struct mutex streamoff_mutex;

int input_cnt;
unsigned int input_cnt;
struct atomisp_input_subdev inputs[ATOM_ISP_MAX_INPUTS];
struct v4l2_subdev *flash;
struct v4l2_subdev *motor;

0 comments on commit 7b065c5

Please sign in to comment.