From: Mauro Carvalho Chehab Date: Tue, 7 Aug 2018 10:36:31 +0000 (-0400) Subject: media: mt9v111: avoid going past the buffer X-Git-Tag: v4.19-rc1~137^2~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d9a71866944967b8622c493ef1b570ccb74e45ae;p=thirdparty%2Fkernel%2Flinux.git media: mt9v111: avoid going past the buffer As warned by smatch: drivers/media/i2c/mt9v111.c:854 mt9v111_enum_frame_size() error: buffer overflow 'mt9v111_frame_sizes' 5 <= 5 drivers/media/i2c/mt9v111.c:855 mt9v111_enum_frame_size() error: buffer overflow 'mt9v111_frame_sizes' 5 <= 5 drivers/media/i2c/mt9v111.c:856 mt9v111_enum_frame_size() error: buffer overflow 'mt9v111_frame_sizes' 5 <= 5 drivers/media/i2c/mt9v111.c:857 mt9v111_enum_frame_size() error: buffer overflow 'mt9v111_frame_sizes' 5 <= 5 Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/i2c/mt9v111.c b/drivers/media/i2c/mt9v111.c index 58d5f2224bff3..70fad09404355 100644 --- a/drivers/media/i2c/mt9v111.c +++ b/drivers/media/i2c/mt9v111.c @@ -848,7 +848,7 @@ static int mt9v111_enum_frame_size(struct v4l2_subdev *subdev, struct v4l2_subdev_pad_config *cfg, struct v4l2_subdev_frame_size_enum *fse) { - if (fse->pad || fse->index > ARRAY_SIZE(mt9v111_frame_sizes)) + if (fse->pad || fse->index >= ARRAY_SIZE(mt9v111_frame_sizes)) return -EINVAL; fse->min_width = mt9v111_frame_sizes[fse->index].width;