On Wed, 2017-03-08 at 11:38 +0100, Hans Verkuil wrote:
> On 01/03/17 16:36, Philipp Zabel wrote:
> > Recently, an unfinished patch was merged that added a third entry to the
> > beginning of the array of firmware locations without changing the code
> > to also look at the third element, thus pushing an old firmware location
> > off the list.
> >
> > Fixes: 8af7779f3cbc ("[media] coda: add Freescale firmware compatibility location")
> > Cc: Baruch Siach <baruch@xxxxxxxxxx>
> > Signed-off-by: Philipp Zabel <p.zabel@xxxxxxxxxxxxxx>
> > ---
> > drivers/media/platform/coda/coda-common.c | 17 ++++++++++-------
> > 1 file changed, 10 insertions(+), 7 deletions(-)
> >
> > diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
> > index eb6548f46cbac..e1a2e8c70db01 100644
> > --- a/drivers/media/platform/coda/coda-common.c
> > +++ b/drivers/media/platform/coda/coda-common.c
> > @@ -2128,6 +2128,9 @@ static int coda_firmware_request(struct coda_dev *dev)
> > {
> > char *fw = dev->devtype->firmware[dev->firmware];
> >
> > + if (dev->firmware >= ARRAY_SIZE(dev->devtype->firmware))
> > + return -EINVAL;
> > +
>
> Move the fw assignment after this 'if'. Otherwise it's reading from undefined memory
> if dev->firmware >= ARRAY_SIZE(dev->devtype->firmware).
>
> Regards,
>
> Hans
Will do, thanks for the review.
regards
Philipp
