[media] atomisp2: off by one in atomisp_s_input()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 26 May 2017 15:28:05 +0000 (12:28 -0300)
committerMauro Carvalho Chehab <mchehab@s-opensource.com>
Wed, 7 Jun 2017 15:42:03 +0000 (12:42 -0300)
commit9dff81436d4d8aa252233bd146d882aaa04094e3
treef50473d650ba1beed190f5175af20e073f561cc7
parent94e23b61486c979e92357f9c3a97a277209720ea
[media] atomisp2: off by one in atomisp_s_input()

The isp->inputs[] array has isp->input_cnt elements which have been
initialized so this > should be >=.

This bug is harmless.  The check against ATOM_ISP_MAX_INPUTS prevents us
from reading beyond the end of the array.  The uninitialized elements
are zeroed out so we will end up returning -EINVAL a few lines later
because the .camera pointer is NULL.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
drivers/staging/media/atomisp/pci/atomisp2/atomisp_ioctl.c