Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd3e9217 authored by Laurent Pinchart's avatar Laurent Pinchart Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (13504): uvcvideo: Fix extension units parsing 



The bNrInPins field is an 8 bit integer, not a 16 bit integer.

Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 6241d8ca

drivers/media/video/uvc/uvc_driver.c

+2 −2
Original line number Diff line number Diff line
@@ -844,7 +844,7 @@ static int uvc_parse_vendor_control(struct uvc_device *dev, 
		unit->type = UVC_VC_EXTENSION_UNIT;

		memcpy(unit->extension.guidExtensionCode, &buffer[4], 16);

		unit->extension.bNumControls = buffer[20];

		unit->extension.bNrInPins = get_unaligned_le16(&buffer[21]);

		unit->extension.bNrInPins = buffer[21];

		unit->extension.baSourceID = (__u8 *)unit + sizeof *unit;

		memcpy(unit->extension.baSourceID, &buffer[22], p);

		unit->extension.bControlSize = buffer[22+p];
@@ -1108,7 +1108,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev, 
		unit->type = buffer[2];

		memcpy(unit->extension.guidExtensionCode, &buffer[4], 16);

		unit->extension.bNumControls = buffer[20];

		unit->extension.bNrInPins = get_unaligned_le16(&buffer[21]);

		unit->extension.bNrInPins = buffer[21];

		unit->extension.baSourceID = (__u8 *)unit + sizeof *unit;

		memcpy(unit->extension.baSourceID, &buffer[22], p);

		unit->extension.bControlSize = buffer[22+p];