Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

[media] cx25821: off by one in cx25821_vidioc_s_input()

If "i" is 2 then when we call cx25821_video_mux() we'd end up going
past the end of the cx25821_boards[dev->board]->input[].

The INPUT() macro obfuscates what's going on in that function so it's
a bit hard to follow. And as Mauro points out the hard coded 2 is
not very helpful.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

authored by

Dan Carpenter and committed by
Mauro Carvalho Chehab
567a23f4 8c4343e5

+3 -2
+1 -1
drivers/media/video/cx25821/cx25821-video.c
··· 1312 1312 return err; 1313 1313 } 1314 1314 1315 - if (i > 2) { 1315 + if (i >= CX25821_NR_INPUT) { 1316 1316 dprintk(1, "%s(): -EINVAL\n", __func__); 1317 1317 return -EINVAL; 1318 1318 }
+2 -1
drivers/media/video/cx25821/cx25821.h
··· 98 98 #define CX25821_BOARD_CONEXANT_ATHENA10 1 99 99 #define MAX_VID_CHANNEL_NUM 12 100 100 #define VID_CHANNEL_NUM 8 101 + #define CX25821_NR_INPUT 2 101 102 102 103 struct cx25821_fmt { 103 104 char *name; ··· 197 196 unsigned char radio_addr; 198 197 199 198 u32 clk_freq; 200 - struct cx25821_input input[2]; 199 + struct cx25821_input input[CX25821_NR_INPUT]; 201 200 }; 202 201 203 202 struct cx25821_subid {