media: staging: atomisp: array underflow in ioctl
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 17 Jul 2017 07:58:54 +0000 (04:58 -0300)
committerMauro Carvalho Chehab <mchehab@s-opensource.com>
Wed, 26 Jul 2017 09:46:42 +0000 (05:46 -0400)
commitf3aa68405d907cdec852078d73a200608d5aa473
treef73ec61f48398d009de864cad07aa9d7e353eb5e
parent9f5039ba440e499d85c29b1ddbc3cbc9dc90e44b
media: staging: atomisp: array underflow in ioctl

I noticed an array underflow in ov5693_enum_frame_size().  The code
looks like this:

int index = fse->index;

if (index >= N_RES)
retur -EINVAL;

fse->index is a u32 that comes from the user.  We want negative values
to be counted as -EINVAL but they aren't.  There are several ways to fix
this but I feel like the best fix for future proofing is to change the
type of N_RES from int to unsigned long to make it the same as if we
were comparing against ARRAY_SIZE().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
drivers/staging/media/atomisp/i2c/gc0310.h
drivers/staging/media/atomisp/i2c/gc2235.h
drivers/staging/media/atomisp/i2c/ov2680.h
drivers/staging/media/atomisp/i2c/ov2722.h
drivers/staging/media/atomisp/i2c/ov5693/ov5693.h