[PATCH] V4L: Add check for valid control ID to v4l2_ctrl_next

If v4l2_ctrl_next is called without the V4L2_CTRL_FLAG_NEXT_CTRL then it
should check whether the passed control ID is valid and return 0 if it
isn't. Otherwise a for-loop over the control IDs will never end.

(cherry picked from commit a46c5fbc6912c4e34cb7ded314249b639dc244a6)

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>

diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
index b87d571e046337122bcfd0759a885ac006089482..31807ba8fffe7ac279e31bce401fadfe84fe47a9 100644 (file)
--- a/drivers/media/video/v4l2-common.c
+++ b/drivers/media/video/v4l2-common.c
@@ -1499,16 +1499,25 @@ int v4l2_ctrl_query_menu(struct v4l2_querymenu *qmenu, struct v4l2_queryctrl *qc
    When no more controls are available 0 is returned. */
 u32 v4l2_ctrl_next(const u32 * const * ctrl_classes, u32 id)
 {
-       u32 ctrl_class;
+       u32 ctrl_class = V4L2_CTRL_ID2CLASS(id);
        const u32 *pctrl;
 
-       /* if no query is desired, then just return the control ID */
-       if ((id & V4L2_CTRL_FLAG_NEXT_CTRL) == 0)
-               return id;
        if (ctrl_classes == NULL)
                return 0;
+
+       /* if no query is desired, then check if the ID is part of ctrl_classes */
+       if ((id & V4L2_CTRL_FLAG_NEXT_CTRL) == 0) {
+               /* find class */
+               while (*ctrl_classes && V4L2_CTRL_ID2CLASS(**ctrl_classes) != ctrl_class)
+                       ctrl_classes++;
+               if (*ctrl_classes == NULL)
+                       return 0;
+               pctrl = *ctrl_classes;
+               /* find control ID */
+               while (*pctrl && *pctrl != id) pctrl++;
+               return *pctrl ? id : 0;
+       }
        id &= V4L2_CTRL_ID_MASK;
-       ctrl_class = V4L2_CTRL_ID2CLASS(id);
        id++;   /* select next control */
        /* find first class that matches (or is greater than) the class of
           the ID */