summaryrefslogtreecommitdiffstats
path: root/drivers/media
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2011-10-13 02:41:41 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2011-11-03 18:33:55 -0200
commit567a23f4389f86c10355ae89909d6d87f312d1a0 (patch)
tree2d9819a0995945ba4dbe0b7ef86f17cd411d53c6 /drivers/media
parent8c4343e5909f956140229b0d960dc7a9c4fd4bdd (diff)
downloadlinux-567a23f4389f86c10355ae89909d6d87f312d1a0.tar.bz2
[media] cx25821: off by one in cx25821_vidioc_s_input()
If "i" is 2 then when we call cx25821_video_mux() we'd end up going past the end of the cx25821_boards[dev->board]->input[]. The INPUT() macro obfuscates what's going on in that function so it's a bit hard to follow. And as Mauro points out the hard coded 2 is not very helpful. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/video/cx25821/cx25821-video.c2
-rw-r--r--drivers/media/video/cx25821/cx25821.h3
2 files changed, 3 insertions, 2 deletions
diff --git a/drivers/media/video/cx25821/cx25821-video.c b/drivers/media/video/cx25821/cx25821-video.c
index 084fc0899e13..4d6907cda75b 100644
--- a/drivers/media/video/cx25821/cx25821-video.c
+++ b/drivers/media/video/cx25821/cx25821-video.c
@@ -1312,7 +1312,7 @@ int cx25821_vidioc_s_input(struct file *file, void *priv, unsigned int i)
return err;
}
- if (i > 2) {
+ if (i >= CX25821_NR_INPUT) {
dprintk(1, "%s(): -EINVAL\n", __func__);
return -EINVAL;
}
diff --git a/drivers/media/video/cx25821/cx25821.h b/drivers/media/video/cx25821/cx25821.h
index db2615b2bac3..2d2d00932823 100644
--- a/drivers/media/video/cx25821/cx25821.h
+++ b/drivers/media/video/cx25821/cx25821.h
@@ -98,6 +98,7 @@
#define CX25821_BOARD_CONEXANT_ATHENA10 1
#define MAX_VID_CHANNEL_NUM 12
#define VID_CHANNEL_NUM 8
+#define CX25821_NR_INPUT 2
struct cx25821_fmt {
char *name;
@@ -196,7 +197,7 @@ struct cx25821_board {
unsigned char radio_addr;
u32 clk_freq;
- struct cx25821_input input[2];
+ struct cx25821_input input[CX25821_NR_INPUT];
};
struct cx25821_subid {