diff options
| author | Jonathan Corbet <corbet-v4l@lwn.net> | 2006-10-13 14:51:16 +0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@infradead.org> | 2006-10-14 07:44:20 +0400 |
| commit | 83427ac5d643308ccb36e05d525949952bdedc27 (patch) | |
| tree | ce2e0b87884e4ed97bf25ea1a43b1c5ea79daa26 | |
| parent | c12e3be0860652ed1e15c9442adcba44317211d1 (diff) | |
| download | linux-83427ac5d643308ccb36e05d525949952bdedc27.tar.xz | |
V4L/DVB (4743): Fix oops in VIDIOC_G_PARM
The call to v4l2_std_construct() in the VIDIOC_G_PARM handler treats
vfd->current_norm as if it were an index - but it's not. The result is
an oops if the driver has no vidioc_g_parm() method defined. Here's the
fix.
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
| -rw-r--r-- | drivers/media/video/videodev.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c index 98de872042a8..d424a4129d69 100644 --- a/drivers/media/video/videodev.c +++ b/drivers/media/video/videodev.c @@ -1288,6 +1288,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file, ret=vfd->vidioc_g_parm(file, fh, p); } else { struct v4l2_standard s; + int i; if (!vfd->tvnormsize) { printk (KERN_WARNING "%s: no TV norms defined!\n", @@ -1298,8 +1299,14 @@ static int __video_do_ioctl(struct inode *inode, struct file *file, if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) return -EINVAL; - v4l2_video_std_construct(&s, vfd->tvnorms[vfd->current_norm].id, - vfd->tvnorms[vfd->current_norm].name); + for (i = 0; i < vfd->tvnormsize; i++) + if (vfd->tvnorms[i].id == vfd->current_norm) + break; + if (i >= vfd->tvnormsize) + return -EINVAL; + + v4l2_video_std_construct(&s, vfd->current_norm, + vfd->tvnorms[i].name); memset(p,0,sizeof(*p)); |