Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a46c5fbc authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (5869): Add check for valid control ID to v4l2_ctrl_next. 



If v4l2_ctrl_next is called without the V4L2_CTRL_FLAG_NEXT_CTRL then it 
should check whether the passed control ID is valid and return 0 if it 
isn't. Otherwise a for-loop over the control IDs will never end.

Signed-off-by: default avatarHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@infradead.org>
parent 3d58ffe2

drivers/media/video/v4l2-common.c

+14 −5
Original line number Diff line number Diff line
@@ -939,16 +939,25 @@ int v4l2_ctrl_query_menu(struct v4l2_querymenu *qmenu, struct v4l2_queryctrl *qc 
   When no more controls are available 0 is returned. */

u32 v4l2_ctrl_next(const u32 * const * ctrl_classes, u32 id)

{

	u32 ctrl_class;

	u32 ctrl_class = V4L2_CTRL_ID2CLASS(id);

	const u32 *pctrl;



	/* if no query is desired, then just return the control ID */

	if ((id & V4L2_CTRL_FLAG_NEXT_CTRL) == 0)

		return id;

	if (ctrl_classes == NULL)

		return 0;



	/* if no query is desired, then check if the ID is part of ctrl_classes */

	if ((id & V4L2_CTRL_FLAG_NEXT_CTRL) == 0) {

		/* find class */

		while (*ctrl_classes && V4L2_CTRL_ID2CLASS(**ctrl_classes) != ctrl_class)

			ctrl_classes++;

		if (*ctrl_classes == NULL)

			return 0;

		pctrl = *ctrl_classes;

		/* find control ID */

		while (*pctrl && *pctrl != id) pctrl++;

		return *pctrl ? id : 0;

	}

	id &= V4L2_CTRL_ID_MASK;

	ctrl_class = V4L2_CTRL_ID2CLASS(id);

	id++;	/* select next control */

	/* find first class that matches (or is greater than) the class of

	   the ID */