From: Dan Carpenter <error27@gmail.com>
Date: Sun, 28 Mar 2010 11:21:18 +0000 (-0300)
Subject: V4L/DVB: video/au0828: off by one bug
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=f5e20c34e9c1bcf9e92f2634411bffd98511fc48;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

V4L/DVB: video/au0828: off by one bug

The "AUVI_INPUT(tmp)" macro uses "tmp" as an index of an array with
AU0828_MAX_INPUT elements.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---

diff --git a/drivers/media/video/au0828/au0828-video.c b/drivers/media/video/au0828/au0828-video.c
index 8c140c01c5e6..66150216f976 100644
--- a/drivers/media/video/au0828/au0828-video.c
+++ b/drivers/media/video/au0828/au0828-video.c
@@ -1105,7 +1105,7 @@ static int vidioc_enum_input(struct file *file, void *priv,
 
 	tmp = input->index;
 
-	if (tmp > AU0828_MAX_INPUT)
+	if (tmp >= AU0828_MAX_INPUT)
 		return -EINVAL;
 	if (AUVI_INPUT(tmp).type == 0)
 		return -EINVAL;