[PATCH] V4L/DVB: keep index within bound in vpfe_cropcap()

[PATCH] V4L/DVB: keep index within bound in vpfe_cropcap()

[Roel Kluin]

If vpfe_dev->std_index equals ARRAY_SIZE(vpfe_standards), that is
one too large

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
 drivers/media/video/davinci/vpfe_capture.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/media/video/davinci/vpfe_capture.c b/drivers/media/video/davinci/vpfe_capture.c
index 402ce43..6b31e59 100644
--- a/drivers/media/video/davinci/vpfe_capture.c
+++ b/drivers/media/video/davinci/vpfe_capture.c
@@ -1577,7 +1577,7 @@ static int vpfe_cropcap(struct file *file, void *priv,
 
 	v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, "vpfe_cropcap\n");
 
-	if (vpfe_dev->std_index > ARRAY_SIZE(vpfe_standards))
+	if (vpfe_dev->std_index >= ARRAY_SIZE(vpfe_standards))
 		return -EINVAL;
 
 	memset(crop, 0, sizeof(struct v4l2_cropcap));

RE: [PATCH] V4L/DVB: keep index within bound in vpfe_cropcap()

[Karicheri, Muralidharan]

Roel,

Thanks for fixing this.

Mauro,

Could you merge this please?

Acked-by Muralidharan Karicheri <m-karicheri2@ti.com> 

Murali Karicheri
Software Design Engineer
Texas Instruments Inc.
Germantown, MD 20874
phone: 301-407-9583
email: m-karicheri2@ti.com

>-----Original Message-----
>From: Roel Kluin [mailto:roel.kluin@gmail.com]
>Sent: Monday, October 26, 2009 7:25 AM
>To: Mauro Carvalho Chehab; linux-media@vger.kernel.org; Andrew Morton;
>Karicheri, Muralidharan
>Subject: [PATCH] V4L/DVB: keep index within bound in vpfe_cropcap()
>
>If vpfe_dev->std_index equals ARRAY_SIZE(vpfe_standards), that is
>one too large
>
>Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
>---
> drivers/media/video/davinci/vpfe_capture.c |    2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
>diff --git a/drivers/media/video/davinci/vpfe_capture.c
>b/drivers/media/video/davinci/vpfe_capture.c
>index 402ce43..6b31e59 100644
>--- a/drivers/media/video/davinci/vpfe_capture.c
>+++ b/drivers/media/video/davinci/vpfe_capture.c
>@@ -1577,7 +1577,7 @@ static int vpfe_cropcap(struct file *file, void *priv,
>
> 	v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, "vpfe_cropcap\n");
>
>-	if (vpfe_dev->std_index > ARRAY_SIZE(vpfe_standards))
>+	if (vpfe_dev->std_index >= ARRAY_SIZE(vpfe_standards))
> 		return -EINVAL;
>
> 	memset(crop, 0, sizeof(struct v4l2_cropcap));