From: Jonathan Corbet <corbet-v4l@lwn.net>
Date: Mon, 25 Sep 2006 23:25:37 +0000 (-0700)
Subject: [PATCH] VIDIOC_ENUMSTD bug
X-Git-Tag: v3.12-rc1~34006
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=b7de567bf3187ccf776e2fe0e241593cdcba5459;p=kernel%2Fkernel-generic.git

[PATCH] VIDIOC_ENUMSTD bug

The v4l2 API documentation for VIDIOC_ENUMSTD says:

	To enumerate all standards applications shall begin at index
	zero, incrementing by one until the driver returns EINVAL.

The actual code, however, tests the index this way:

               if (index<=0 || index >= vfd->tvnormsize) {
                        ret=-EINVAL;

So any application which passes in index=0 gets EINVAL right off the bat
- and, in fact, this is what happens to mplayer.  So I think the
following patch is called for, and maybe even appropriate for a 2.6.18.x
stable release.

Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---

diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c
index 88bf2af..edd7b83 100644
--- a/drivers/media/video/videodev.c
+++ b/drivers/media/video/videodev.c
@@ -836,7 +836,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
 			break;
 		}
 
-		if (index<=0 || index >= vfd->tvnormsize) {
+		if (index < 0 || index >= vfd->tvnormsize) {
 			ret=-EINVAL;
 			break;
 		}