提交 83427ac5 编写于 作者: J Jonathan Corbet 提交者: Mauro Carvalho Chehab

V4L/DVB (4743): Fix oops in VIDIOC_G_PARM

The call to v4l2_std_construct() in the VIDIOC_G_PARM handler treats
vfd->current_norm as if it were an index - but it's not.  The result is
an oops if the driver has no vidioc_g_parm() method defined.  Here's the
fix.
Signed-off-by: NJonathan Corbet <corbet@lwn.net>
Signed-off-by: NMauro Carvalho Chehab <mchehab@infradead.org>
上级 c12e3be0
...@@ -1288,6 +1288,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file, ...@@ -1288,6 +1288,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
ret=vfd->vidioc_g_parm(file, fh, p); ret=vfd->vidioc_g_parm(file, fh, p);
} else { } else {
struct v4l2_standard s; struct v4l2_standard s;
int i;
if (!vfd->tvnormsize) { if (!vfd->tvnormsize) {
printk (KERN_WARNING "%s: no TV norms defined!\n", printk (KERN_WARNING "%s: no TV norms defined!\n",
...@@ -1298,8 +1299,14 @@ static int __video_do_ioctl(struct inode *inode, struct file *file, ...@@ -1298,8 +1299,14 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
return -EINVAL; return -EINVAL;
v4l2_video_std_construct(&s, vfd->tvnorms[vfd->current_norm].id, for (i = 0; i < vfd->tvnormsize; i++)
vfd->tvnorms[vfd->current_norm].name); if (vfd->tvnorms[i].id == vfd->current_norm)
break;
if (i >= vfd->tvnormsize)
return -EINVAL;
v4l2_video_std_construct(&s, vfd->current_norm,
vfd->tvnorms[i].name);
memset(p,0,sizeof(*p)); memset(p,0,sizeof(*p));
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册