diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-01-08 07:07:08 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2015-01-27 10:15:07 -0200 |
| commit | 88ca3af44beb281979e3f037d167cc3fec68c9de (patch) | |
| tree | 288733b781ab030af73fc1352db3ff4ac7b1ce9d | |
| parent | 35655bf85473abae9ff76f25ec6b321f9935c7bc (diff) | |
| download | linux-88ca3af44beb281979e3f037d167cc3fec68c9de.tar.gz linux-88ca3af44beb281979e3f037d167cc3fec68c9de.tar.bz2 linux-88ca3af44beb281979e3f037d167cc3fec68c9de.zip | |
[media] coda: improve safety in coda_register_device()
The "i" variable is used as an offset into both the dev->vfd[] and the
dev->devtype->vdevs[] arrays. The second array is smaller so we should
use that as a limit instead of ARRAY_SIZE(dev->vfd). Also the original
check was off by one.
We should use a format string as well in case the ->name has any funny
characters and also to stop static checkers from complaining.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
| -rw-r--r-- | drivers/media/platform/coda/coda-common.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c index efed0b802943..ea7a0dcf1530 100644 --- a/drivers/media/platform/coda/coda-common.c +++ b/drivers/media/platform/coda/coda-common.c @@ -1844,10 +1844,11 @@ static int coda_register_device(struct coda_dev *dev, int i) { struct video_device *vfd = &dev->vfd[i]; - if (i > ARRAY_SIZE(dev->vfd)) + if (i >= dev->devtype->num_vdevs) return -EINVAL; - snprintf(vfd->name, sizeof(vfd->name), dev->devtype->vdevs[i]->name); + snprintf(vfd->name, sizeof(vfd->name), "%s", + dev->devtype->vdevs[i]->name); vfd->fops = &coda_fops; vfd->ioctl_ops = &coda_ioctl_ops; vfd->release = video_device_release_empty, |