]> git.baikalelectronics.ru Git - kernel.git/commit
media: atomisp2: Array underflow in atomisp_enum_input()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 19 Jul 2017 09:55:47 +0000 (05:55 -0400)
committerMauro Carvalho Chehab <mchehab@s-opensource.com>
Wed, 26 Jul 2017 12:24:22 +0000 (08:24 -0400)
commitc2e77722528b33f5d3674409ae9d449fd0dad79b
tree2e7bddd3b3c1e5ecb12a893145a4ebd80e3baa87
parenta232dde2c2c36dd2f2798c82f75ef277dc4ff1c4
media: atomisp2: Array underflow in atomisp_enum_input()

The problem here is this code from atomisp_enum_input():

   581          int index = input->index;
   582
   583          if (index >= isp->input_cnt)
   584                  return -EINVAL;
   585
   586          if (!isp->inputs[index].camera)
   587                  return -EINVAL;

"input->index" is a u32 which comes from the ioctl.  We want negative
values of "index" to be counted as -EINVAL but they aren't.  I've fixed
this by changing the type of "isp->input_cnt" to unsigned int.

Fixes: f40413881fa2 ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
drivers/staging/media/atomisp/pci/atomisp2/atomisp_internal.h