From: Dan Carpenter Date: Thu, 1 Mar 2018 10:07:14 +0000 (-0500) Subject: media: ov5695: Off by one in ov5695_enum_frame_sizes() X-Git-Tag: v4.17-rc1~143^2~183 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f68e68d2923069fd9b21aa1e7ed445cda2f6db05;p=thirdparty%2Fkernel%2Flinux.git media: ov5695: Off by one in ov5695_enum_frame_sizes() The ">" should be ">=" so that we don't read one element beyond the end of the array. Fixes: 8a77009be4be ("media: ov5695: add support for OV5695 sensor") Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/i2c/ov5695.c b/drivers/media/i2c/ov5695.c index a4985a4715f55..9be38a0a20466 100644 --- a/drivers/media/i2c/ov5695.c +++ b/drivers/media/i2c/ov5695.c @@ -884,7 +884,7 @@ static int ov5695_enum_frame_sizes(struct v4l2_subdev *sd, struct v4l2_subdev_pad_config *cfg, struct v4l2_subdev_frame_size_enum *fse) { - if (fse->index > ARRAY_SIZE(supported_modes)) + if (fse->index >= ARRAY_SIZE(supported_modes)) return -EINVAL; if (fse->code != MEDIA_BUS_FMT_SBGGR10_1X10)