Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9dff8143 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab
Browse files

[media] atomisp2: off by one in atomisp_s_input() 



The isp->inputs[] array has isp->input_cnt elements which have been
initialized so this > should be >=.

This bug is harmless.  The check against ATOM_ISP_MAX_INPUTS prevents us
from reading beyond the end of the array.  The uninitialized elements
are zeroed out so we will end up returning -EINVAL a few lines later
because the .camera pointer is NULL.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent 94e23b61

drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c

+1 −1
Original line number Diff line number Diff line
@@ -683,7 +683,7 @@ static int atomisp_s_input(struct file *file, void *fh, unsigned int input) 
	int ret;



	rt_mutex_lock(&isp->mutex);

	if (input >= ATOM_ISP_MAX_INPUTS || input > isp->input_cnt) {

	if (input >= ATOM_ISP_MAX_INPUTS || input >= isp->input_cnt) {

		dev_dbg(isp->dev, "input_cnt: %d\n", isp->input_cnt);

		ret = -EINVAL;

		goto error;