Commit 2132deff authored Mar 10, 2010 by Dan Carpenter Committed by Mauro Carvalho Chehab May 06, 2010

V4L/DVB: omap24xxcam: potential buffer overflow



The previous loop goes until last == VIDEO_MAX_FRAME, so this could
potentially go one past the end of the loop.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Sakari Ailus <sakari.ailus@maxwell.research.nokia.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

parent 722154e4

drivers/media/video/omap24xxcam.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1405,7 +1405,7 @@ static int omap24xxcam_mmap_buffers(struct file *file,
		}

		size = 0;
		for (i = first; i <= last; i++) {
		for (i = first; i <= last && i < VIDEO_MAX_FRAME; i++) {
		struct videobuf_dmabuf *dma = videobuf_to_dma(vbq->bufs[i]);

		for (j = 0; j < dma->sglen; j++) {

Admin message