diff mbox

videobuf2-core: make checking condition more strict

Message ID 1408504315-3114-1-git-send-email-zhaowei.yuan@samsung.com
State New, archived
Headers show

Commit Message

Zhaowei Yuan Aug. 20, 2014, 3:11 a.m. UTC
It's also invalid that plane_no equals to vb->num_planes

Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
---
 drivers/media/v4l2-core/videobuf2-core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-samsung-soc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Sylwester Nawrocki Aug. 20, 2014, 9:26 a.m. UTC | #1
On 20/08/14 05:11, Zhaowei Yuan wrote:
> It's also invalid that plane_no equals to vb->num_planes

The patch looks good to me but I would make the summary line more 
specific, e.g. "vb2: fix plane index sanity check in vb2_plane_cookie()".

I think this patch should be backported to the stable trees.

> Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
> ---
>  drivers/media/v4l2-core/videobuf2-core.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
> index c359006..1ae4e57 100644
> --- a/drivers/media/v4l2-core/videobuf2-core.c
> +++ b/drivers/media/v4l2-core/videobuf2-core.c
> @@ -1130,7 +1130,7 @@ EXPORT_SYMBOL_GPL(vb2_plane_vaddr);
>   */
>  void *vb2_plane_cookie(struct vb2_buffer *vb, unsigned int plane_no)
>  {
> -	if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
> +	if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
>  		return NULL;
> 
>  	return call_ptr_memop(vb, cookie, vb->planes[plane_no].mem_priv);
> --
> 1.7.9.5
diff mbox

Patch

diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index c359006..1ae4e57 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -1130,7 +1130,7 @@  EXPORT_SYMBOL_GPL(vb2_plane_vaddr);
  */
 void *vb2_plane_cookie(struct vb2_buffer *vb, unsigned int plane_no)
 {
-	if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
+	if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
 		return NULL;

 	return call_ptr_memop(vb, cookie, vb->planes[plane_no].mem_priv);