Hi Guennadi,
On Monday 14 April 2014 15:49:34 Guennadi Liakhovetski wrote:
> Commit 75e2bdad8901a0b599e01a96229be922eef1e488 "ov7670: allow
> configuration of image size, clock speed, and I/O method" uses a wrong
> index to iterate an array. Apart from being wrong, it also uses an
> unchecked value from user-space, which can cause access to unmapped
> memory in the kernel, triggered by a normal desktop user with rights to
> use V4L2 devices.
>
> Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@xxxxxx>
> ---
>
> Jonathan,
> I'd prefer to first post it to the lists to maybe have someone test it ;)
> Otherwise - I've got a couple more fixes for 3.15, which I hope to make
> ready and push in a couple of weeks... So, with your ack I can take this
> one too, or, if you prefer to push it earlier - would be good too.
What's your plan for this patch ? Will you send a pull request ? Alternatively
I can take it in my tree.
> drivers/media/i2c/ov7670.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
> index e8a1ce2..cdd7c1b 100644
> --- a/drivers/media/i2c/ov7670.c
> +++ b/drivers/media/i2c/ov7670.c
> @@ -1109,7 +1109,7 @@ static int ov7670_enum_framesizes(struct v4l2_subdev
> *sd, * windows that fall outside that.
> */
> for (i = 0; i < n_win_sizes; i++) {
> - struct ov7670_win_size *win = &info->devtype->win_sizes[index];
> + struct ov7670_win_size *win = &info->devtype->win_sizes[i];
> if (info->min_width && win->width < info->min_width)
> continue;
> if (info->min_height && win->height < info->min_height)
--
Regards,
Laurent Pinchart
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
