From 0b56d1c8fd8991b0ae5255151c54ed20deb49a28 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 10 Aug 2017 08:23:34 -0400 Subject: [PATCH] media: staging: atomisp: fix bounds checking in mt9m114_s_exposure_selection() These clamp_t() calls are no-ops because we don't save the results. It leads to an array out of bounds bug. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Dan Carpenter Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/atomisp/i2c/mt9m114.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/staging/media/atomisp/i2c/mt9m114.c b/drivers/staging/media/atomisp/i2c/mt9m114.c index 36a0636a532f..3c837cb8859c 100644 --- a/drivers/staging/media/atomisp/i2c/mt9m114.c +++ b/drivers/staging/media/atomisp/i2c/mt9m114.c @@ -1209,10 +1209,10 @@ static int mt9m114_s_exposure_selection(struct v4l2_subdev *sd, return -EINVAL; } - clamp_t(int, win_left, 0, 4); - clamp_t(int, win_top, 0, 4); - clamp_t(int, win_right, 0, 4); - clamp_t(int, win_bottom, 0, 4); + win_left = clamp_t(int, win_left, 0, 4); + win_top = clamp_t(int, win_top, 0, 4); + win_right = clamp_t(int, win_right, 0, 4); + win_bottom = clamp_t(int, win_bottom, 0, 4); ret = mt9m114_write_reg_array(client, mt9m114_exp_average, NO_POLLING); if (ret) { -- 2.20.1