media: davinci/vpbe: array underflow in vpbe_enum_outputs() (b72845ee) · Commits · 戴 / test

In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but the problem is that "temp_index" can be negative. This patch changes the types to unsigned to address this array underflow bug. Fixes: ("[media] davinci vpbe: VPBE display driver") Signed-off-by:

Dan Carpenter <dan.carpenter@oracle.com> Acked-by:

"Lad, Prabhakar" <prabhakar.csengg@gmail.com> Signed-off-by:

Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:

Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

drivers/media/platform/davinci/vpbe.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -104,7 +104,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
		struct v4l2_output *output)
		{
		struct vpbe_config *cfg = vpbe_dev->cfg;
		int temp_index = output->index;
		unsigned int temp_index = output->index;

		if (temp_index >= cfg->num_outputs)
		return -EINVAL;

include/media/davinci/vpbe.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -92,7 +92,7 @@ struct vpbe_config {
		struct encoder_config_info *ext_encoders;
		/* amplifier information goes here */
		struct amp_config_info *amp;
		int num_outputs;
		unsigned int num_outputs;
		/* Order is venc outputs followed by LCD and then external encoders */
		struct vpbe_output *outputs;
		};

Admin message