From patchwork Fri Jul 24 10:45:46 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roel Kluin X-Patchwork-Id: 37119 X-Patchwork-Delegate: dougsland@redhat.com Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n6OAhOen026844 for ; Fri, 24 Jul 2009 10:43:24 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752575AbZGXKnV (ORCPT ); Fri, 24 Jul 2009 06:43:21 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752588AbZGXKnV (ORCPT ); Fri, 24 Jul 2009 06:43:21 -0400 Received: from mail-ew0-f226.google.com ([209.85.219.226]:38577 "EHLO mail-ew0-f226.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752575AbZGXKnU (ORCPT ); Fri, 24 Jul 2009 06:43:20 -0400 Received: by ewy26 with SMTP id 26so1638687ewy.37 for ; Fri, 24 Jul 2009 03:43:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:subject:content-type :content-transfer-encoding; bh=Q3XC/QmDJDHhu7LWr/1S2ukbmR51G8lXYtfS7nusE/E=; b=ONL/UPe+mW3bUAI1MNzMOzju/SjLckYOxQZxwSLC/pIt9SlGqFYbSZuiYP2/wUhu7K Z73TnFQYd+KPACwQ+UbWlxnCzF2UyoIcnktsOvGRgiJA2Ut/2pFTehZ4dYdwdlpka8Nw AHFLnIjbfqW5NbnKhfkd1OIHHTeq/wIJSCHbE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; b=HWMgNMAni0BrjgKd7ibvaf0A5hP+pjqf6oohLqj321Z3dDfjJm8LJX3T3HNz6h+0ss fBaXrpUW/Ku6ogXzdOZgQkZ8e3HabKNMFdc8uwYrdsCYNQ9AG+Z+XSNdYvWOgma79coF 51Eo9APYtM48jutdwKEHMNKzsKBqDd5yBV+/E= Received: by 10.210.11.13 with SMTP id 13mr4063662ebk.9.1248432199644; Fri, 24 Jul 2009 03:43:19 -0700 (PDT) Received: from zoinx.mars (d133062.upc-d.chello.nl [213.46.133.62]) by mx.google.com with ESMTPS id 10sm2105284eyz.41.2009.07.24.03.43.18 (version=SSLv3 cipher=RC4-MD5); Fri, 24 Jul 2009 03:43:19 -0700 (PDT) Message-ID: <4A6990DA.3070002@gmail.com> Date: Fri, 24 Jul 2009 12:45:46 +0200 From: Roel Kluin User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b3pre) Gecko/20090513 Fedora/3.0-2.3.beta2.fc11 Thunderbird/3.0b2 MIME-Version: 1.0 To: mchehab@infradead.org, linux-media@vger.kernel.org, Andrew Morton Subject: [PATCH] stk-webcam: Read buffer overflow Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org It tested the value of stk_sizes[i].m before checking whether i was in range. Signed-off-by: Roel Kluin --- -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/media/video/stk-webcam.c b/drivers/media/video/stk-webcam.c index 4d6785e..b154bd9 100644 --- a/drivers/media/video/stk-webcam.c +++ b/drivers/media/video/stk-webcam.c @@ -1050,8 +1050,8 @@ static int stk_setup_format(struct stk_camera *dev) depth = 1; else depth = 2; - while (stk_sizes[i].m != dev->vsettings.mode - && i < ARRAY_SIZE(stk_sizes)) + while (i < ARRAY_SIZE(stk_sizes) && + stk_sizes[i].m != dev->vsettings.mode) i++; if (i == ARRAY_SIZE(stk_sizes)) { STK_ERROR("Something is broken in %s\n", __func__);