On Fri Apr 10 00:41:58 2026 +0300, Mohamad El Harake wrote:
> gmin_cfg_get_dsm() iterates over ACPI _DSM package elements as
> key/value pairs using obj->package.count - 1 as the loop bound.
>
> If package.count is 0, the subtraction underflows and may lead
> to out-of-bounds access.
>
> Use i + 1 < obj->package.count instead.
>
> Signed-off-by: Mohamad El Harake <[email protected]>
> Reviewed-by: Hans de Goede <[email protected]>
> Signed-off-by: Sakari Ailus <[email protected]>
Patch committed.
Thanks,
Sakari Ailus
drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c
b/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c
index ba61cc28fac1..cca91c6d71a5 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c
@@ -113,7 +113,7 @@ static char *gmin_cfg_get_dsm(struct acpi_device *adev,
const char *key)
if (!obj)
return NULL;
- for (i = 0; i < obj->package.count - 1; i += 2) {
+ for (i = 0; i + 1 < obj->package.count; i += 2) {
key_el = &obj->package.elements[i + 0];
val_el = &obj->package.elements[i + 1];
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
