From: Dan Carpenter Date: Fri, 23 Aug 2013 08:33:48 +0000 (-0300) Subject: [media] ov9650: off by one in ov965x_enum_frame_sizes() X-Git-Tag: firefly_0821_release~176^2~3573^2~1349 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=6a4760ed50e4908cfd597be0d840a0cb990aff7a;p=firefly-linux-kernel-4.4.55.git [media] ov9650: off by one in ov965x_enum_frame_sizes() The ">" should be ">=" otherwise we read one space beyond the end of the array. Signed-off-by: Dan Carpenter Signed-off-by: Sylwester Nawrocki Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/i2c/ov9650.c b/drivers/media/i2c/ov9650.c index 1dbb8118a285..4da90c621f7e 100644 --- a/drivers/media/i2c/ov9650.c +++ b/drivers/media/i2c/ov9650.c @@ -1083,7 +1083,7 @@ static int ov965x_enum_frame_sizes(struct v4l2_subdev *sd, { int i = ARRAY_SIZE(ov965x_formats); - if (fse->index > ARRAY_SIZE(ov965x_framesizes)) + if (fse->index >= ARRAY_SIZE(ov965x_framesizes)) return -EINVAL; while (--i)