projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 07aac5d)
media: qcom: don't go past the array
authorMauro Carvalho Chehab <mchehab@s-opensource.com>
Sat, 26 Aug 2017 19:34:37 +0000 (15:34 -0400)
committerMauro Carvalho Chehab <mchehab@s-opensource.com>
Sat, 26 Aug 2017 19:34:37 +0000 (15:34 -0400)
As reported by smatch:

drivers/media/platform/qcom/camss-8x16/camss-vfe.c:1136 vfe_release_wm() error: buffer overflow 'vfe->wm_output_map' 7 <= 7

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
drivers/media/platform/qcom/camss-8x16/camss-vfe.c patch | blob | blame | history

diff --git a/drivers/media/platform/qcom/camss-8x16/camss-vfe.c b/drivers/media/platform/qcom/camss-8x16/camss-vfe.c
index 94d635e00aa18526892041e0713ae7fe9328aa6b..b21b3c2dc77f2bb12f617f198a928a58cc17b592 100644 (file)
--- a/drivers/media/platform/qcom/camss-8x16/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss-8x16/camss-vfe.c
@@ -1130,7 +1130,7 @@ static int vfe_reserve_wm(struct vfe_device *vfe, enum vfe_line_id line_id)
 
 static int vfe_release_wm(struct vfe_device *vfe, u8 wm)
 {
-       if (wm > ARRAY_SIZE(vfe->wm_output_map))
+       if (wm >= ARRAY_SIZE(vfe->wm_output_map))
                return -EINVAL;
 
        vfe->wm_output_map[wm] = VFE_LINE_NONE;