From: Roel Kluin <roel.kluin@gmail.com>
Date: Wed, 4 Nov 2009 17:16:25 +0000 (-0300)
Subject: V4L/DVB (13285): vpfe_capture: keep index within bound in vpfe_cropcap()
X-Git-Tag: upstream/snapshot3+hdmi~16399^2~176
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=0b66cf90371dcd28c6eb98904adb694ae98eb20f;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git

V4L/DVB (13285): vpfe_capture: keep index within bound in vpfe_cropcap()

If vpfe_dev->std_index equals ARRAY_SIZE(vpfe_standards), that is
one too large.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Muralidharan Karicheri <m-karicheri2@ti.com>
Signed-off-by: Douglas Schilling Landgraf <dougsland@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---

diff --git a/drivers/media/video/davinci/vpfe_capture.c b/drivers/media/video/davinci/vpfe_capture.c
index 402ce43..6b31e59 100644
--- a/drivers/media/video/davinci/vpfe_capture.c
+++ b/drivers/media/video/davinci/vpfe_capture.c
@@ -1577,7 +1577,7 @@ static int vpfe_cropcap(struct file *file, void *priv,
 
 	v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, "vpfe_cropcap\n");
 
-	if (vpfe_dev->std_index > ARRAY_SIZE(vpfe_standards))
+	if (vpfe_dev->std_index >= ARRAY_SIZE(vpfe_standards))
 		return -EINVAL;
 
 	memset(crop, 0, sizeof(struct v4l2_cropcap));