| Message ID | 7d222638-2d19-466d-8dd4-9e1ceb1d46f3@moroto.mountain (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | media: staging: starfive: camss: fix off by one in isp_enum_mbus_code() | expand |
On 2023/11/28 22:40, Dan Carpenter wrote: > These > comparisons should be >=. The formats->fmts[] array is either > a pointer to isp_formats_sink[] or isp_formats_source[] respectively. > > Fixes: e57854628f58 ("media: staging: media: starfive: camss: Add ISP driver") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Changhuang Liang <changhuang.liang@starfivetech.com> > --- > drivers/staging/media/starfive/camss/stf-isp.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/staging/media/starfive/camss/stf-isp.c b/drivers/staging/media/starfive/camss/stf-isp.c > index 893dbd8cddc8..98d61d71c31b 100644 > --- a/drivers/staging/media/starfive/camss/stf-isp.c > +++ b/drivers/staging/media/starfive/camss/stf-isp.c > @@ -120,7 +120,7 @@ static int isp_enum_mbus_code(struct v4l2_subdev *sd, > const struct stf_isp_format_table *formats; > > if (code->pad == STF_ISP_PAD_SINK) { > - if (code->index > ARRAY_SIZE(isp_formats_sink)) > + if (code->index >= ARRAY_SIZE(isp_formats_sink)) > return -EINVAL; > > formats = &isp_dev->formats[SINK_FORMATS_INDEX]; > @@ -128,7 +128,7 @@ static int isp_enum_mbus_code(struct v4l2_subdev *sd, > } else { > struct v4l2_mbus_framefmt *sink_fmt; > > - if (code->index > ARRAY_SIZE(isp_formats_source)) > + if (code->index >= ARRAY_SIZE(isp_formats_source)) > return -EINVAL; > > sink_fmt = v4l2_subdev_state_get_format(state,
diff --git a/drivers/staging/media/starfive/camss/stf-isp.c b/drivers/staging/media/starfive/camss/stf-isp.c index 893dbd8cddc8..98d61d71c31b 100644 --- a/drivers/staging/media/starfive/camss/stf-isp.c +++ b/drivers/staging/media/starfive/camss/stf-isp.c @@ -120,7 +120,7 @@ static int isp_enum_mbus_code(struct v4l2_subdev *sd, const struct stf_isp_format_table *formats; if (code->pad == STF_ISP_PAD_SINK) { - if (code->index > ARRAY_SIZE(isp_formats_sink)) + if (code->index >= ARRAY_SIZE(isp_formats_sink)) return -EINVAL; formats = &isp_dev->formats[SINK_FORMATS_INDEX]; @@ -128,7 +128,7 @@ static int isp_enum_mbus_code(struct v4l2_subdev *sd, } else { struct v4l2_mbus_framefmt *sink_fmt; - if (code->index > ARRAY_SIZE(isp_formats_source)) + if (code->index >= ARRAY_SIZE(isp_formats_source)) return -EINVAL; sink_fmt = v4l2_subdev_state_get_format(state,
These > comparisons should be >=. The formats->fmts[] array is either a pointer to isp_formats_sink[] or isp_formats_source[] respectively. Fixes: e57854628f58 ("media: staging: media: starfive: camss: Add ISP driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- drivers/staging/media/starfive/camss/stf-isp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)