diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-03-10 07:57:03 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-05-06 19:18:58 -0300 |
| commit | 2132deff694765bc2e6c7ac84c6b30dab0775256 (patch) | |
| tree | d91bb367c9150c8aaec45af5257ecb1aa6b145aa | |
| parent | 722154e4cacf015161efe60009ae9be23d492296 (diff) | |
V4L/DVB: omap24xxcam: potential buffer overflow
The previous loop goes until last == VIDEO_MAX_FRAME, so this could
potentially go one past the end of the loop.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Sakari Ailus <sakari.ailus@maxwell.research.nokia.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| -rw-r--r-- | drivers/media/video/omap24xxcam.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c index b189fe63394b..ce76d952e161 100644 --- a/drivers/media/video/omap24xxcam.c +++ b/drivers/media/video/omap24xxcam.c @@ -1405,7 +1405,7 @@ static int omap24xxcam_mmap_buffers(struct file *file, } size = 0; - for (i = first; i <= last; i++) { + for (i = first; i <= last && i < VIDEO_MAX_FRAME; i++) { struct videobuf_dmabuf *dma = videobuf_to_dma(vbq->bufs[i]); for (j = 0; j < dma->sglen; j++) { |