From bd0b5a35aac5315cf4f6d296dee2f23fb28b827d Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 25 Jan 2018 09:15:25 -0500 Subject: media: sr030pc30: prevent array underflow in try_fmt() Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab --- drivers/media/i2c/sr030pc30.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'drivers/media/i2c/sr030pc30.c') diff --git a/drivers/media/i2c/sr030pc30.c b/drivers/media/i2c/sr030pc30.c index 0bf031b7e4fa..2a4882cddc51 100644 --- a/drivers/media/i2c/sr030pc30.c +++ b/drivers/media/i2c/sr030pc30.c @@ -511,13 +511,16 @@ static int sr030pc30_get_fmt(struct v4l2_subdev *sd, static const struct sr030pc30_format *try_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) { - int i = ARRAY_SIZE(sr030pc30_formats); + int i; sr030pc30_try_frame_size(mf); - while (i--) + for (i = 0; i < ARRAY_SIZE(sr030pc30_formats); i++) { if (mf->code == sr030pc30_formats[i].code) break; + } + if (i == ARRAY_SIZE(sr030pc30_formats)) + i = 0; mf->code = sr030pc30_formats[i].code; -- cgit v1.2.3