V4L/DVB (8362): gspca: Bad offset of the brightness sum in sn9c103 packets.

Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 19 insertions, 7 deletions

diff --git a/drivers/media/video/gspca/sonixb.c b/drivers/media/video/gspca/sonixb.c
index 80879bf3188f..a512772664a3 100644
--- a/drivers/media/video/gspca/sonixb.c
+++ b/drivers/media/video/gspca/sonixb.c
@@ -1033,6 +1033,15 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
         int i;
         struct sd *sd = (struct sd *) gspca_dev;
 
+        /* frames start with:
+         *      ff ff 00 c4 c4 96       synchro
+         *      00              (unknown)
+         *      xx              (frame sequence / size / compression)
+         *      (xx)            (idem - extra byte for sn9c103)
+         *      ll mm           brightness sum inside auto exposure
+         *      ll mm           brightness sum outside auto exposure
+         *      (xx xx xx xx xx)        audio values for snc103
+         */
         if (len > 6 && len < 24) {
                 for (i = 0; i < len - 6; i++) {
                         if (data[0 + i] == 0xff
@@ -1043,15 +1052,18 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                             && data[5 + i] == 0x96) {   /* start of frame */
                                 frame = gspca_frame_add(gspca_dev, LAST_PACKET,
                                                         frame, data, 0);
-                                if (i < (len - 10)) {
-                                        atomic_set(&sd->avg_lum, data[i + 8] +
+                                if (len - i < sd->fr_h_sz) {
+                                        atomic_set(&sd->avg_lum, -1);
+                                        PDEBUG(D_STREAM, "packet too short to"
+                                                " get avg brightness");
+                                } else if (sd->fr_h_sz == 12) {
+                                        atomic_set(&sd->avg_lum,
+                                                data[i + 8] +
                                                         (data[i + 9] << 8));
                                 } else {
-                                        atomic_set(&sd->avg_lum, -1);
-#ifdef CONFIG_VIDEO_ADV_DEBUG
-                                        PDEBUG(D_STREAM, "packet too short to "
-                                                "get avg brightness");
-#endif
+                                        atomic_set(&sd->avg_lum,
+                                                data[i + 9] +
+                                                        (data[i + 10] << 8));
                                 }
                                 data += i + sd->fr_h_sz;
                                 len -= i + sd->fr_h_sz;