[media] gspca - main: Check the isoc packet status before its length

When an error is set for an isochronous packet, the length of the packet
may be null. In this case, the error was not detected and the image
was not discarded as it should be.

Reported-by: Franck Bourdonnec <fbourdonnec@chez.com>
Signed-off-by: Jean-François Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 5a2274b2b0e8ed962f55c33678fefb56447e7d27..03381c68b986d995294d1719bf86f0008e287936 100644 (file)
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -320,12 +320,6 @@ static void fill_frame(struct gspca_dev *gspca_dev,
        for (i = 0; i < urb->number_of_packets; i++) {
 
                /* check the packet status and length */
-               len = urb->iso_frame_desc[i].actual_length;
-               if (len == 0) {
-                       if (gspca_dev->empty_packet == 0)
-                               gspca_dev->empty_packet = 1;
-                       continue;
-               }
                st = urb->iso_frame_desc[i].status;
                if (st) {
                        err("ISOC data error: [%d] len=%d, status=%d",
@@ -333,6 +327,12 @@ static void fill_frame(struct gspca_dev *gspca_dev,
                        gspca_dev->last_packet_type = DISCARD_PACKET;
                        continue;
                }
+               len = urb->iso_frame_desc[i].actual_length;
+               if (len == 0) {
+                       if (gspca_dev->empty_packet == 0)
+                               gspca_dev->empty_packet = 1;
+                       continue;
+               }
 
                /* let the packet be analyzed by the subdriver */
                PDEBUG(D_PACK, "packet [%d] o:%d l:%d",