diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-03-28 07:21:18 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-05-19 11:57:21 -0400 |
| commit | f5e20c34e9c1bcf9e92f2634411bffd98511fc48 (patch) | |
| tree | 5140e1cc2d739f129bd3c285ba723fdcb2a841ec | |
| parent | 6e1f4df7da6edd21a184daff023a8eef67f005dc (diff) | |
V4L/DVB: video/au0828: off by one bug
The "AUVI_INPUT(tmp)" macro uses "tmp" as an index of an array with
AU0828_MAX_INPUT elements.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| -rw-r--r-- | drivers/media/video/au0828/au0828-video.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/video/au0828/au0828-video.c b/drivers/media/video/au0828/au0828-video.c index 8c140c01c5e6..66150216f976 100644 --- a/drivers/media/video/au0828/au0828-video.c +++ b/drivers/media/video/au0828/au0828-video.c | |||
| @@ -1105,7 +1105,7 @@ static int vidioc_enum_input(struct file *file, void *priv, | |||
| 1105 | 1105 | ||
| 1106 | tmp = input->index; | 1106 | tmp = input->index; |
| 1107 | 1107 | ||
| 1108 | if (tmp > AU0828_MAX_INPUT) | 1108 | if (tmp >= AU0828_MAX_INPUT) |
| 1109 | return -EINVAL; | 1109 | return -EINVAL; |
| 1110 | if (AUVI_INPUT(tmp).type == 0) | 1110 | if (AUVI_INPUT(tmp).type == 0) |
| 1111 | return -EINVAL; | 1111 | return -EINVAL; |