Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 83427ac5 authored by Jonathan Corbet's avatar Jonathan Corbet Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (4743): Fix oops in VIDIOC_G_PARM 



The call to v4l2_std_construct() in the VIDIOC_G_PARM handler treats
vfd->current_norm as if it were an index - but it's not.  The result is
an oops if the driver has no vidioc_g_parm() method defined.  Here's the
fix.

Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@infradead.org>
parent c12e3be0

drivers/media/video/videodev.c

+9 −2
Original line number Diff line number Diff line
@@ -1288,6 +1288,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file, 
			ret=vfd->vidioc_g_parm(file, fh, p);

		} else {

			struct v4l2_standard s;

			int i;



			if (!vfd->tvnormsize) {

				printk (KERN_WARNING "%s: no TV norms defined!\n",
@@ -1298,8 +1299,14 @@ static int __video_do_ioctl(struct inode *inode, struct file *file, 
			if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)

				return -EINVAL;



			v4l2_video_std_construct(&s, vfd->tvnorms[vfd->current_norm].id,

						 vfd->tvnorms[vfd->current_norm].name);

			for (i = 0; i < vfd->tvnormsize; i++)

				if (vfd->tvnorms[i].id == vfd->current_norm)

					break;

			if (i >= vfd->tvnormsize)

				return -EINVAL;



			v4l2_video_std_construct(&s, vfd->current_norm,

						 vfd->tvnorms[i].name);



			memset(p,0,sizeof(*p));