From: Colin King <colin.king@canonical.com>
To: Jacopo Mondi <jacopo@jmondi.org>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
linux-media@vger.kernel.org
Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH][media-next] media: i2c: mt9v111: fix off-by-one array bounds check
Date: Tue, 31 Jul 2018 13:33:43 +0000 [thread overview]
Message-ID: <20180731133343.22337-1-colin.king@canonical.com> (raw)
From: Colin Ian King <colin.king@canonical.com>
The check of fse->index is off-by-one and should be using >= rather
than > to check the maximum allowed array index. Fix this.
Detected by CoverityScan, CID#172122 ("Out-of-bounds read")
Fixes: aab7ed1c3927 ("media: i2c: Add driver for Aptina MT9V111")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/media/i2c/mt9v111.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/mt9v111.c b/drivers/media/i2c/mt9v111.c
index da8f6ab91307..b1d13f1d695e 100644
--- a/drivers/media/i2c/mt9v111.c
+++ b/drivers/media/i2c/mt9v111.c
@@ -848,7 +848,7 @@ static int mt9v111_enum_frame_size(struct v4l2_subdev *subdev,
struct v4l2_subdev_pad_config *cfg,
struct v4l2_subdev_frame_size_enum *fse)
{
- if (fse->pad || fse->index > ARRAY_SIZE(mt9v111_frame_sizes))
+ if (fse->pad || fse->index >= ARRAY_SIZE(mt9v111_frame_sizes))
return -EINVAL;
fse->min_width = mt9v111_frame_sizes[fse->index].width;
--
2.17.1
next reply other threads:[~2018-07-31 13:33 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-31 13:33 Colin King [this message]
2018-07-31 13:53 ` [PATCH][media-next] media: i2c: mt9v111: fix off-by-one array bounds check jacopo mondi
2018-07-31 13:55 ` Colin Ian King
2018-07-31 14:01 ` jacopo mondi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180731133343.22337-1-colin.king@canonical.com \
--to=colin.king@canonical.com \
--cc=jacopo@jmondi.org \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox