[media] s5k6aa: off by one in s5k6aa_enum_frame_interval()

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

The check is off by one so we could read one space past the end of the
array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

authored by

Dan Carpenter and committed by

Mauro Carvalho Chehab 12 years ago 174e60ad d345a5e5

+1 -1

1 changed file

expand all

drivers

media

i2c

s5k6aa.c

+1 -1

drivers/media/i2c/s5k6aa.c

··· 1003 1003 const struct s5k6aa_interval *fi; 1004 1004 int ret = 0; 1005 1005 1006 - if (fie->index > ARRAY_SIZE(s5k6aa_intervals)) 1006 + if (fie->index >= ARRAY_SIZE(s5k6aa_intervals)) 1007 1007 return -EINVAL; 1008 1008 1009 1009 v4l_bound_align_image(&fie->width, S5K6AA_WIN_WIDTH_MIN,