Re: [PATCH v2 1/7] media: synopsys: Fix out-of-bounds check in enum_mbus_code

[Frank Li <Frank.li@nxp.com>]

On Thu, Apr 23, 2026 at 04:22:56PM +0800, Guoniu Zhou wrote:
> dw_mipi_csi2rx_enum_mbus_code() contains an off-by-one error in the
> bounds check for code->index, allowing an access past the end of the
> formats array.
>
> Fixes: 355a11004066 ("media: synopsys: add driver for the designware mipi csi-2 receiver")
> Signed-off-by: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> Changes in v2:
> - New added in v2
> ---
>  drivers/media/platform/synopsys/dw-mipi-csi2rx.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/synopsys/dw-mipi-csi2rx.c b/drivers/media/platform/synopsys/dw-mipi-csi2rx.c
> index ce17f986279e..02eb4a6cafad 100644
> --- a/drivers/media/platform/synopsys/dw-mipi-csi2rx.c
> +++ b/drivers/media/platform/synopsys/dw-mipi-csi2rx.c
> @@ -430,7 +430,7 @@ dw_mipi_csi2rx_enum_mbus_code(struct v4l2_subdev *sd,
>
>  		return 0;
>  	case DW_MIPI_CSI2RX_PAD_SINK:
> -		if (code->index > csi2->formats_num)
> +		if (code->index >= csi2->formats_num)
>  			return -EINVAL;
>
>  		code->code = csi2->formats[code->index].code;
>
> --
> 2.34.1
>