video VIDIO_QBUF ioctl: Check range of index parameter

Signed-off-by: Johannes Thoma <johannes@johannesthoma.com>
boundarydevices · Jan 13, 2021 · 5272544 · 5272544
1 parent d23084b
commit 5272544
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/drivers/media/platform/mxc/capture/mxc_v4l2_capture.c b/drivers/media/platform/mxc/capture/mxc_v4l2_capture.c
@@ -2123,6 +2123,10 @@ static long mxc_v4l_do_ioctl(struct file *file,
 		int index = buf->index;
 		pr_debug("   case VIDIOC_QBUF, length=%d\n", buf->length);
 
+		if (index < 0 || index >= FRAME_NUM) {
+			retval = -EINVAL;
+			break;
+		}
 		spin_lock_irqsave(&cam->queue_int_lock, lock_flags);
 		if ((cam->frame[index].buffer.flags & 0x7) ==
 		    V4L2_BUF_FLAG_MAPPED) {