V4L/DVB (4743): Fix oops in VIDIOC_G_PARM

The call to v4l2_std_construct() in the VIDIOC_G_PARM handler treats
vfd->current_norm as if it were an index - but it's not.  The result is
an oops if the driver has no vidioc_g_parm() method defined.  Here's the
fix.

Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c
index 98de872042a8dacf81b770dde98359ac1181466d..d424a4129d69ba188772282ec9f29a95374218c9 100644 (file)
--- a/drivers/media/video/videodev.c
+++ b/drivers/media/video/videodev.c
@@ -1288,6 +1288,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
                        ret=vfd->vidioc_g_parm(file, fh, p);
                } else {
                        struct v4l2_standard s;
+                       int i;
 
                        if (!vfd->tvnormsize) {
                                printk (KERN_WARNING "%s: no TV norms defined!\n",
@@ -1298,8 +1299,14 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
                        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
                                return -EINVAL;
 
-                       v4l2_video_std_construct(&s, vfd->tvnorms[vfd->current_norm].id,
-                                                vfd->tvnorms[vfd->current_norm].name);
+                       for (i = 0; i < vfd->tvnormsize; i++)
+                               if (vfd->tvnorms[i].id == vfd->current_norm)
+                                       break;
+                       if (i >= vfd->tvnormsize)
+                               return -EINVAL;
+
+                       v4l2_video_std_construct(&s, vfd->current_norm,
+                                                vfd->tvnorms[i].name);
 
                        memset(p,0,sizeof(*p));