projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 722154e)
V4L/DVB: omap24xxcam: potential buffer overflow
authorDan Carpenter <error27@gmail.com>
Wed, 10 Mar 2010 10:57:03 +0000 (07:57 -0300)
committerMauro Carvalho Chehab <mchehab@redhat.com>
Thu, 6 May 2010 22:18:58 +0000 (19:18 -0300)
The previous loop goes until last == VIDEO_MAX_FRAME, so this could
potentially go one past the end of the loop.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Sakari Ailus <sakari.ailus@maxwell.research.nokia.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/media/video/omap24xxcam.c patch | blob | blame | history

diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c
index b189fe63394b79a0364d9fd0b3f6dd94dab93a8f..ce76d952e1613682b1948762d6be26caffee21b4 100644 (file)
--- a/drivers/media/video/omap24xxcam.c
+++ b/drivers/media/video/omap24xxcam.c
@@ -1405,7 +1405,7 @@ static int omap24xxcam_mmap_buffers(struct file *file,
        }
 
        size = 0;
-       for (i = first; i <= last; i++) {
+       for (i = first; i <= last && i < VIDEO_MAX_FRAME; i++) {
                struct videobuf_dmabuf *dma = videobuf_to_dma(vbq->bufs[i]);
 
                for (j = 0; j < dma->sglen; j++) {