From 46bec667b675573cf1ce698c68112e3dbd31930e Mon Sep 17 00:00:00 2001 From: Sergio Aguirre Date: Wed, 25 Apr 2012 08:57:13 -0500 Subject: Compare name length to avoid false positives in media_get_entity_by_name If two subdevice have names that only differ by a suffix (such as "OMAP4 ISS ISP IPIPE" and "OMAP4 ISS ISP IPIPEIF") the media_get_entity_by_name function might return a pointer to the entity with the longest name when called with the shortest name. Fix this by verifying that the candidate entity name length is equal to the requested name length. Signed-off-by: Sergio Aguirre Signed-off-by: Laurent Pinchart --- src/mediactl.c | 9 ++++++++- src/tools.h | 1 + 2 files changed, 9 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/mediactl.c b/src/mediactl.c index 5b8c587..bc6a713 100644 --- a/src/mediactl.c +++ b/src/mediactl.c @@ -63,10 +63,17 @@ struct media_entity *media_get_entity_by_name(struct media_device *media, { unsigned int i; + /* A match is impossible if the entity name is longer than the maximum + * size we can get from the kernel. + */ + if (length >= FIELD_SIZEOF(struct media_entity_desc, name)) + return NULL; + for (i = 0; i < media->entities_count; ++i) { struct media_entity *entity = &media->entities[i]; - if (strncmp(entity->info.name, name, length) == 0) + if (strncmp(entity->info.name, name, length) == 0 && + entity->info.name[length] == '\0') return entity; } diff --git a/src/tools.h b/src/tools.h index e56edb2..de06cb3 100644 --- a/src/tools.h +++ b/src/tools.h @@ -23,6 +23,7 @@ #define __TOOLS_H__ #define ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) +#define FIELD_SIZEOF(t, f) (sizeof(((t*)0)->f)) #endif /* __TOOLS_H__ */ -- cgit v1.2.3