From: Jonathan Corbet <[email protected]>
The call to v4l2_std_construct() in the VIDIOC_G_PARM handler treats
vfd->current_norm as if it were an index - but it's not. The result is
an oops if the driver has no vidioc_g_parm() method defined. Here's the
fix.
Signed-off-by: Jonathan Corbet <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
---
drivers/media/video/videodev.c | 11 +++++++++--
1 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c
index 98de872..d424a41 100644
--- a/drivers/media/video/videodev.c
+++ b/drivers/media/video/videodev.c
@@ -1288,6 +1288,7 @@ #endif
ret=vfd->vidioc_g_parm(file, fh, p);
} else {
struct v4l2_standard s;
+ int i;
if (!vfd->tvnormsize) {
printk (KERN_WARNING "%s: no TV norms defined!\n",
@@ -1298,8 +1299,14 @@ #endif
if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
return -EINVAL;
- v4l2_video_std_construct(&s, vfd->tvnorms[vfd->current_norm].id,
- vfd->tvnorms[vfd->current_norm].name);
+ for (i = 0; i < vfd->tvnormsize; i++)
+ if (vfd->tvnorms[i].id == vfd->current_norm)
+ break;
+ if (i >= vfd->tvnormsize)
+ return -EINVAL;
+
+ v4l2_video_std_construct(&s, vfd->current_norm,
+ vfd->tvnorms[i].name);
memset(p,0,sizeof(*p));
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
