Hi Gerd et all,
I think there's a off-by-one error in bttv-driver.c (bttv 0.8.37):
[..]
if (b->index < 0 || b->index > VIDEO_MAX_FRAME)
return -EINVAL;
[..]
twice, once for VIDIOC_QUERYBUF and once for VIDIOC_QBUF (both in the
ioctl handler function in bttv-driver.c). It should be "b->index >=
VIDEO_MAX_FRAME" instead of "b->index > VIDEO_MAX_FRAME".
Attached is a small patch to correct that.
Ronald
--
- .-.
- /V\ | Ronald Bultje <[EMAIL PROTECTED]>
- // \\ | Running: Linux 2.4.18-XFS and OpenBSD 3.0
- /( )\ | http://ronald.bitfreak.net/
- ^^-^^
--- bttv-driver-orig.c Fri Mar 22 14:02:03 2002
+++ bttv-driver.c Fri Mar 22 14:02:42 2002
@@ -2239,7 +2239,7 @@
if ((b->type & V4L2_BUF_TYPE_field) != V4L2_BUF_TYPE_CAPTURE)
return -EINVAL;
- if (b->index < 0 || b->index > VIDEO_MAX_FRAME)
+ if (b->index < 0 || b->index >= VIDEO_MAX_FRAME)
return -EINVAL;
if (NULL == fh->bufs[b->index])
return -EINVAL;
@@ -2254,7 +2254,7 @@
if ((b->type & V4L2_BUF_TYPE_field) != V4L2_BUF_TYPE_CAPTURE)
return -EINVAL;
- if (b->index < 0 || b->index > VIDEO_MAX_FRAME)
+ if (b->index < 0 || b->index >= VIDEO_MAX_FRAME)
return -EINVAL;
down(&fh->lock);