Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3aff03d9 authored by Daniel W. S. Almeida's avatar Daniel W. S. Almeida Committed by Greg Kroah-Hartman
Browse files

media: uvcvideo: Fix dereference of out-of-bound list iterator 

[ Upstream commit f875bcc375c738bf2f599ff2e1c5b918dbd07c45 ]

Fixes the following coccinelle report:

drivers/media/usb/uvc/uvc_ctrl.c:1860:5-11:
ERROR: invalid reference to the index variable of the iterator on line 1854

by adding a boolean variable to check if the loop has found the

Found using - Coccinelle (http://coccinelle.lip6.fr

)

[Replace cursor variable with bool found]

Signed-off-by: default avatarDaniel W. S. Almeida <dwlsalmeida@gmail.com>
Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent cbc03ded

drivers/media/usb/uvc/uvc_ctrl.c

+9 −4
Original line number Diff line number Diff line
@@ -1853,30 +1853,35 @@ int uvc_xu_ctrl_query(struct uvc_video_chain *chain, 
{

	struct uvc_entity *entity;

	struct uvc_control *ctrl;

	unsigned int i, found = 0;

	unsigned int i;

	bool found;

	u32 reqflags;

	u16 size;

	u8 *data = NULL;

	int ret;



	/* Find the extension unit. */

	found = false;

	list_for_each_entry(entity, &chain->entities, chain) {

		if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT &&

		    entity->id == xqry->unit)

		    entity->id == xqry->unit) {

			found = true;

			break;

		}

	}



	if (entity->id != xqry->unit) {

	if (!found) {

		uvc_trace(UVC_TRACE_CONTROL, "Extension unit %u not found.\n",

			xqry->unit);

		return -ENOENT;

	}



	/* Find the control and perform delayed initialization if needed. */

	found = false;

	for (i = 0; i < entity->ncontrols; ++i) {

		ctrl = &entity->controls[i];

		if (ctrl->index == xqry->selector - 1) {

			found = 1;

			found = true;

			break;

		}

	}