Commit f875bcc3 authored by Daniel W. S. Almeida's avatar Daniel W. S. Almeida Committed by Mauro Carvalho Chehab
Browse files

media: uvcvideo: Fix dereference of out-of-bound list iterator 

Fixes the following coccinelle report:

drivers/media/usb/uvc/uvc_ctrl.c:1860:5-11:
ERROR: invalid reference to the index variable of the iterator on line 1854

by adding a boolean variable to check if the loop has found the

Found using - Coccinelle (http://coccinelle.lip6.fr

)

[Replace cursor variable with bool found]

Signed-off-by: default avatarDaniel W. S. Almeida <dwlsalmeida@gmail.com>
Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent f5a3048a

drivers/media/usb/uvc/uvc_ctrl.c

+9 −4
Original line number Original line Diff line number Diff line
@@ -1844,30 +1844,35 @@ int uvc_xu_ctrl_query(struct uvc_video_chain *chain, 
{

{

	struct uvc_entity *entity;

	struct uvc_entity *entity;

	struct uvc_control *ctrl;

	struct uvc_control *ctrl;

	unsigned int i, found = 0;

	unsigned int i;

	bool found;

	u32 reqflags;

	u32 reqflags;

	u16 size;

	u16 size;

	u8 *data = NULL;

	u8 *data = NULL;

	int ret;

	int ret;





	/* Find the extension unit. */

	/* Find the extension unit. */

	found = false;

	list_for_each_entry(entity, &chain->entities, chain) {

	list_for_each_entry(entity, &chain->entities, chain) {

		if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT &&

		if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT &&

		    entity->id == xqry->unit)

		    entity->id == xqry->unit) {

			found = true;

			break;

			break;

		}

		}

	}





	if (entity->id != xqry->unit) {

	if (!found) {

		uvc_trace(UVC_TRACE_CONTROL, "Extension unit %u not found.\n",

		uvc_trace(UVC_TRACE_CONTROL, "Extension unit %u not found.\n",

			xqry->unit);

			xqry->unit);

		return -ENOENT;

		return -ENOENT;

	}

	}





	/* Find the control and perform delayed initialization if needed. */

	/* Find the control and perform delayed initialization if needed. */

	found = false;

	for (i = 0; i < entity->ncontrols; ++i) {

	for (i = 0; i < entity->ncontrols; ++i) {

		ctrl = &entity->controls[i];

		ctrl = &entity->controls[i];

		if (ctrl->index == xqry->selector - 1) {

		if (ctrl->index == xqry->selector - 1) {

			found = 1;

			found = true;

			break;

			break;

		}

		}

	}

	}