From 83427ac5d643308ccb36e05d525949952bdedc27 Mon Sep 17 00:00:00 2001 From: Jonathan Corbet Date: Fri, 13 Oct 2006 07:51:16 -0300 Subject: V4L/DVB (4743): Fix oops in VIDIOC_G_PARM The call to v4l2_std_construct() in the VIDIOC_G_PARM handler treats vfd->current_norm as if it were an index - but it's not. The result is an oops if the driver has no vidioc_g_parm() method defined. Here's the fix. Signed-off-by: Jonathan Corbet Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/videodev.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'drivers/media') diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c index 98de872042a..d424a4129d6 100644 --- a/drivers/media/video/videodev.c +++ b/drivers/media/video/videodev.c @@ -1288,6 +1288,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file, ret=vfd->vidioc_g_parm(file, fh, p); } else { struct v4l2_standard s; + int i; if (!vfd->tvnormsize) { printk (KERN_WARNING "%s: no TV norms defined!\n", @@ -1298,8 +1299,14 @@ static int __video_do_ioctl(struct inode *inode, struct file *file, if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) return -EINVAL; - v4l2_video_std_construct(&s, vfd->tvnorms[vfd->current_norm].id, - vfd->tvnorms[vfd->current_norm].name); + for (i = 0; i < vfd->tvnormsize; i++) + if (vfd->tvnorms[i].id == vfd->current_norm) + break; + if (i >= vfd->tvnormsize) + return -EINVAL; + + v4l2_video_std_construct(&s, vfd->current_norm, + vfd->tvnorms[i].name); memset(p,0,sizeof(*p)); -- cgit v1.2.3