From: Dan Carpenter Date: Thu, 10 Aug 2017 12:23:34 +0000 (-0400) Subject: media: staging: atomisp: fix bounds checking in mt9m114_s_exposure_selection() X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=0b56d1c8fd8991b0ae5255151c54ed20deb49a28;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git media: staging: atomisp: fix bounds checking in mt9m114_s_exposure_selection() These clamp_t() calls are no-ops because we don't save the results. It leads to an array out of bounds bug. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Dan Carpenter Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/staging/media/atomisp/i2c/mt9m114.c b/drivers/staging/media/atomisp/i2c/mt9m114.c index 36a0636a532f..3c837cb8859c 100644 --- a/drivers/staging/media/atomisp/i2c/mt9m114.c +++ b/drivers/staging/media/atomisp/i2c/mt9m114.c @@ -1209,10 +1209,10 @@ static int mt9m114_s_exposure_selection(struct v4l2_subdev *sd, return -EINVAL; } - clamp_t(int, win_left, 0, 4); - clamp_t(int, win_top, 0, 4); - clamp_t(int, win_right, 0, 4); - clamp_t(int, win_bottom, 0, 4); + win_left = clamp_t(int, win_left, 0, 4); + win_top = clamp_t(int, win_top, 0, 4); + win_right = clamp_t(int, win_right, 0, 4); + win_bottom = clamp_t(int, win_bottom, 0, 4); ret = mt9m114_write_reg_array(client, mt9m114_exp_average, NO_POLLING); if (ret) {