[media] coda: improve safety in coda_register_device()
The "i" variable is used as an offset into both the dev->vfd[] and the
dev->devtype->vdevs[] arrays. The second array is smaller so we should
use that as a limit instead of ARRAY_SIZE(dev->vfd). Also the original
check was off by one.
We should use a format string as well in case the ->name has any funny
characters and also to stop static checkers from complaining.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
index efed0b8..ea7a0dc 100644
--- a/drivers/media/platform/coda/coda-common.c
+++ b/drivers/media/platform/coda/coda-common.c
@@ -1844,10 +1844,11 @@
{
struct video_device *vfd = &dev->vfd[i];
- if (i > ARRAY_SIZE(dev->vfd))
+ if (i >= dev->devtype->num_vdevs)
return -EINVAL;
- snprintf(vfd->name, sizeof(vfd->name), dev->devtype->vdevs[i]->name);
+ snprintf(vfd->name, sizeof(vfd->name), "%s",
+ dev->devtype->vdevs[i]->name);
vfd->fops = &coda_fops;
vfd->ioctl_ops = &coda_ioctl_ops;
vfd->release = video_device_release_empty,