Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88ca3af4 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab
Browse files

[media] coda: improve safety in coda_register_device() 



The "i" variable is used as an offset into both the dev->vfd[] and the
dev->devtype->vdevs[] arrays.  The second array is smaller so we should
use that as a limit instead of ARRAY_SIZE(dev->vfd).  Also the original
check was off by one.

We should use a format string as well in case the ->name has any funny
characters and also to stop static checkers from complaining.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent 35655bf8

drivers/media/platform/coda/coda-common.c

+3 −2
Original line number Diff line number Diff line
@@ -1844,10 +1844,11 @@ static int coda_register_device(struct coda_dev *dev, int i) 
{

	struct video_device *vfd = &dev->vfd[i];



	if (i > ARRAY_SIZE(dev->vfd))

	if (i >= dev->devtype->num_vdevs)

		return -EINVAL;



	snprintf(vfd->name, sizeof(vfd->name), dev->devtype->vdevs[i]->name);

	snprintf(vfd->name, sizeof(vfd->name), "%s",

		 dev->devtype->vdevs[i]->name);

	vfd->fops	= &coda_fops;

	vfd->ioctl_ops	= &coda_ioctl_ops;

	vfd->release	= video_device_release_empty,