Received: by 10.213.65.68 with SMTP id h4csp1743516imn; Mon, 19 Mar 2018 12:02:59 -0700 (PDT) X-Google-Smtp-Source: AG47ELuGXzb8xSzLmRaALEZSAac0km7OIPjsEKWG/VhLs2+nzLgvlqHKJeTgg+4DmRY/KXQCPeNE X-Received: by 10.101.91.199 with SMTP id o7mr10089076pgr.9.1521486179180; Mon, 19 Mar 2018 12:02:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1521486179; cv=none; d=google.com; s=arc-20160816; b=EX31dz33f+mo6FcuaOzKjykkYthTx2vpxb63SLDKG4LW8eutaxL/6nvk89eoxzN+ym A96jJolh0pax391rMRuwUaER+WPq1I+YaaiaY12Vbei3SSlv6K2zUVmjrOFzMUQ37ZZW DSjYxRBaKXzh8q5x94czdyAXi2mURMrkH65yUQll62M7gMHUs7cuDEwVwdB+oDs0zrPZ BKb4BHASwEG1m/w9UlNqhUgv5DQBgNsrmtr6u8C9DLGTV2NmI7hptiQ4fFVLT8usPfqC kss66lNV63adS/8AW8goW+LK9BB50hLgN5JVu/7SJLvuBzQwFGT/rrWCx8WZOL6oN5RI yeHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=QovJBloNsRJYfvXsQnDYGeTTOUinUrc0f5CHxxKvQ5E=; b=rfGQ8KHbbqx06nCtGEKpK0c1a1TEBGCSacWclY0yTLExG9yjTMm8vJoWsYcyczEi3j QKxHDRK/dfxlZOOU68DfBMb4mCd05yUJc5m5iffbivcnPXZ80SH26LOhMF00kX8IUGZp xfwp/sY55qMR6PI+suh8pNB+R35+2IWmOUUoNhFxrxdqQMdS7iVDNP5EzVbu5Fi2IOQN HmV+k+IZHhR6GbJoKqbsaCIZPRNqDkaVWgb2kfG+fDDT10UCKdec8sWSMeO5n+yRNiJL 6AMwl9uV/vebXJdtFNZo/8o8M6GE1nBKjYVci+QY8CbzCGCrXjub+Dy85QKbxw/ulGvH EaKA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d71si340522pgc.411.2018.03.19.12.02.44; Mon, 19 Mar 2018 12:02:59 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S969953AbeCSS2x (ORCPT + 99 others); Mon, 19 Mar 2018 14:28:53 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:50968 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S969966AbeCSS0t (ORCPT ); Mon, 19 Mar 2018 14:26:49 -0400 Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 18A2D11D5; Mon, 19 Mar 2018 18:26:48 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 198/241] media: cpia2: Fix a couple off by one bugs Date: Mon, 19 Mar 2018 19:07:43 +0100 Message-Id: <20180319180759.393591393@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180319180751.172155436@linuxfoundation.org> References: <20180319180751.172155436@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Carpenter [ Upstream commit d5ac225c7d64c9c3ef821239edc035634e594ec9 ] The cam->buffers[] array has cam->num_frames elements so the > needs to be changed to >= to avoid going beyond the end of the array. The ->buffers[] array is allocated in cpia2_allocate_buffers() if you want to confirm. Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support") Signed-off-by: Dan Carpenter Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/cpia2/cpia2_v4l.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/cpia2/cpia2_v4l.c +++ b/drivers/media/usb/cpia2/cpia2_v4l.c @@ -812,7 +812,7 @@ static int cpia2_querybuf(struct file *f struct camera_data *cam = video_drvdata(file); if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || - buf->index > cam->num_frames) + buf->index >= cam->num_frames) return -EINVAL; buf->m.offset = cam->buffers[buf->index].data - cam->frame_buffer; @@ -863,7 +863,7 @@ static int cpia2_qbuf(struct file *file, if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || buf->memory != V4L2_MEMORY_MMAP || - buf->index > cam->num_frames) + buf->index >= cam->num_frames) return -EINVAL; DBG("QBUF #%d\n", buf->index);