[PATCH 1/1] v4l: subdev: Check for pads in [gs]_frame_interval

[Sakari Ailus]

The validity of the pad field in struct v4l2_subdev_frame_interval was not
ensured by the V4L2 subdev IOCTL helper. Fix this.

Signed-off-by: Sakari Ailus <sakari.ai...@linux.intel.com>
---
 drivers/media/v4l2-core/v4l2-subdev.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-subdev.c 
b/drivers/media/v4l2-core/v4l2-subdev.c
index 996c248..3fa1907 100644
--- a/drivers/media/v4l2-core/v4l2-subdev.c
+++ b/drivers/media/v4l2-core/v4l2-subdev.c
@@ -305,11 +305,23 @@ static long subdev_do_ioctl(struct file *file, unsigned 
int cmd, void *arg)
                                        fse);
        }
 
-       case VIDIOC_SUBDEV_G_FRAME_INTERVAL:
+       case VIDIOC_SUBDEV_G_FRAME_INTERVAL: {
+               struct v4l2_subdev_frame_interval *fi = arg;
+
+               if (fi->pad >= sd->entity.num_pads)
+                       return -EINVAL;
+
                return v4l2_subdev_call(sd, video, g_frame_interval, arg);
+       }
+
+       case VIDIOC_SUBDEV_S_FRAME_INTERVAL: {
+               struct v4l2_subdev_frame_interval *fi = arg;
+
+               if (fi->pad >= sd->entity.num_pads)
+                       return -EINVAL;
 
-       case VIDIOC_SUBDEV_S_FRAME_INTERVAL:
                return v4l2_subdev_call(sd, video, s_frame_interval, arg);
+       }
 
        case VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL: {
                struct v4l2_subdev_frame_interval_enum *fie = arg;
-- 
1.8.3.2

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html