diff options
| author |   Akinobu Mita <akinobu.mita@gmail.com> | 2019-04-17 10:06:39 -0400 |
|---|---|---|
| committer |   Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | 2019-05-23 05:39:38 -0400 |
| commit | 6e4ab830ac6d6a0d7cd7f87dc5d6536369bf24a8 (patch) | |
| tree | faa6134ef8851aabc42d525995f28d82ac905557 | |
| parent | media: ov7740: fix unbalanced pm_runtime_get/put (diff) | |
| download | linux-dev-6e4ab830ac6d6a0d7cd7f87dc5d6536369bf24a8.tar.xz linux-dev-6e4ab830ac6d6a0d7cd7f87dc5d6536369bf24a8.zip | |
media: ov7740: avoid invalid framesize setting
If the requested framesize by VIDIOC_SUBDEV_S_FMT is larger than supported
framesizes, it causes an out of bounds array access and the resulting
framesize is unexpected.
Avoid out of bounds array access and select the default framesize.
Cc: Wenyou Yang <wenyou.yang@microchip.com>
Cc: Eugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
| -rw-r--r-- | drivers/media/i2c/ov7740.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/media/i2c/ov7740.c b/drivers/media/i2c/ov7740.c index d122e350478c..5c0dfdf6756a 100644 --- a/drivers/media/i2c/ov7740.c +++ b/drivers/media/i2c/ov7740.c @@ -785,7 +785,11 @@ static int ov7740_try_fmt_internal(struct v4l2_subdev *sd, fsize++; } - + if (i >= ARRAY_SIZE(ov7740_framesizes)) { + fsize = &ov7740_framesizes[0]; + fmt->width = fsize->width; + fmt->height = fsize->height; + } if (ret_frmsize != NULL) *ret_frmsize = fsize; |