V4L/DVB (8195): gspca: Input buffer overwritten in spca561 + cleanup code.

[cascardo/linux.git] / drivers / media / video / gspca / conex.c

diff --git a/drivers/media/video/gspca/conex.c b/drivers/media/video/gspca/conex.c
index 473bea7..6d50247 100644 (file)
--- a/drivers/media/video/gspca/conex.c
+++ b/drivers/media/video/gspca/conex.c
@@ -25,8 +25,8 @@
 #define CONEX_CAM 1            /* special JPEG header */
 #include "jpeg.h"
 
-#define DRIVER_VERSION_NUMBER  KERNEL_VERSION(2, 1, 3)
-static const char version[] = "2.1.3";
+#define DRIVER_VERSION_NUMBER  KERNEL_VERSION(2, 1, 4)
+static const char version[] = "2.1.4";
 
 MODULE_AUTHOR("Michel Xhaard <mxhaard@users.sourceforge.net>");
 MODULE_DESCRIPTION("GSPCA USB Conexant Camera Driver");
@@ -229,7 +229,7 @@ static void cx11646_fw(struct gspca_dev*gspca_dev)
        reg_w(gspca_dev->dev, 0x006a, &val, 1);
 }
 
-static __u8 cxsensor[] = {
+static const __u8 cxsensor[] = {
        0x88, 0x12, 0x70, 0x01,
        0x88, 0x0d, 0x02, 0x01,
        0x88, 0x0f, 0x00, 0x01,
@@ -244,24 +244,24 @@ static __u8 cxsensor[] = {
        0x00
 };
 
-static __u8 reg20[] = { 0x10, 0x42, 0x81, 0x19, 0xd3, 0xff, 0xa7, 0xff };
-static __u8 reg28[] = { 0x87, 0x00, 0x87, 0x00, 0x8f, 0xff, 0xea, 0xff };
-static __u8 reg10[] = { 0xb1, 0xb1 };
-static __u8 reg71a[] = { 0x08, 0x18, 0x0a, 0x1e };     /* 640 */
-static __u8 reg71b[] = { 0x04, 0x0c, 0x05, 0x0f };
+static const __u8 reg20[] = { 0x10, 0x42, 0x81, 0x19, 0xd3, 0xff, 0xa7, 0xff };
+static const __u8 reg28[] = { 0x87, 0x00, 0x87, 0x00, 0x8f, 0xff, 0xea, 0xff };
+static const __u8 reg10[] = { 0xb1, 0xb1 };
+static const __u8 reg71a[] = { 0x08, 0x18, 0x0a, 0x1e };       /* 640 */
+static const __u8 reg71b[] = { 0x04, 0x0c, 0x05, 0x0f };
        /* 352{0x04,0x0a,0x06,0x12}; //352{0x05,0x0e,0x06,0x11}; //352 */
-static __u8 reg71c[] = { 0x02, 0x07, 0x03, 0x09 };
+static const __u8 reg71c[] = { 0x02, 0x07, 0x03, 0x09 };
                                        /* 320{0x04,0x0c,0x05,0x0f}; //320 */
-static __u8 reg71d[] = { 0x02, 0x07, 0x03, 0x09 };     /* 176 */
-static __u8 reg7b[] = { 0x00, 0xff, 0x00, 0xff, 0x00, 0xff };
+static const __u8 reg71d[] = { 0x02, 0x07, 0x03, 0x09 };       /* 176 */
+static const __u8 reg7b[] = { 0x00, 0xff, 0x00, 0xff, 0x00, 0xff };
 
 static void cx_sensor(struct gspca_dev*gspca_dev)
 {
-       __u8 val = 0;
+       __u8 val;
        int i = 0;
        __u8 bufread[] = { 0, 0, 0, 0, 0, 0, 0, 0 };
-       int length = 0;
-       __u8 *ptsensor = cxsensor;
+       int length;
+       const __u8 *ptsensor = cxsensor;
 
        reg_w(gspca_dev->dev, 0x0020, reg20, 8);
        reg_w(gspca_dev->dev, 0x0028, reg28, 8);
@@ -305,7 +305,7 @@ static void cx_sensor(struct gspca_dev*gspca_dev)
        reg_r(gspca_dev->dev, 0x00e7, bufread, 8);
 }
 
-static __u8 cx_inits_176[] = {
+static const __u8 cx_inits_176[] = {
        0x33, 0x81, 0xB0, 0x00, 0x90, 0x00, 0x0A, 0x03, /* 176x144 */
        0x00, 0x03, 0x03, 0x03, 0x1B, 0x05, 0x30, 0x03,
        0x65, 0x15, 0x18, 0x25, 0x03, 0x25, 0x08, 0x30,
@@ -314,7 +314,7 @@ static __u8 cx_inits_176[] = {
        0xF7, 0xFF, 0x88, 0xFF, 0x66, 0x02, 0x28, 0x02,
        0x1E, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
-static __u8 cx_inits_320[] = {
+static const __u8 cx_inits_320[] = {
        0x7f, 0x7f, 0x40, 0x01, 0xf0, 0x00, 0x02, 0x01,
        0x00, 0x01, 0x01, 0x01, 0x10, 0x00, 0x02, 0x01,
        0x65, 0x45, 0xfa, 0x4c, 0x2c, 0xdf, 0xb9, 0x81,
@@ -323,7 +323,7 @@ static __u8 cx_inits_320[] = {
        0xf5, 0xff, 0x6d, 0xff, 0xf6, 0x01, 0x43, 0x02,
        0xd3, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
-static __u8 cx_inits_352[] = {
+static const __u8 cx_inits_352[] = {
        0x2e, 0x7c, 0x60, 0x01, 0x20, 0x01, 0x05, 0x03,
        0x00, 0x06, 0x03, 0x06, 0x1b, 0x10, 0x05, 0x3b,
        0x30, 0x25, 0x18, 0x25, 0x08, 0x30, 0x03, 0x25,
@@ -332,7 +332,7 @@ static __u8 cx_inits_352[] = {
        0xf5, 0xff, 0x6b, 0xff, 0xee, 0x01, 0x43, 0x02,
        0xe4, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
-static __u8 cx_inits_640[] = {
+static const __u8 cx_inits_640[] = {
        0x7e, 0x7e, 0x80, 0x02, 0xe0, 0x01, 0x01, 0x01,
        0x00, 0x02, 0x01, 0x02, 0x10, 0x30, 0x01, 0x01,
        0x65, 0x45, 0xf7, 0x52, 0x2c, 0xdf, 0xb9, 0x81,
@@ -344,7 +344,7 @@ static __u8 cx_inits_640[] = {
 
 static int cx11646_initsize(struct gspca_dev *gspca_dev)
 {
-       __u8 *cxinit;
+       const __u8 *cxinit;
        __u8 val;
        static const __u8 reg12[] = { 0x08, 0x05, 0x07, 0x04, 0x24 };
        static const __u8 reg17[] =
@@ -396,7 +396,7 @@ static int cx11646_initsize(struct gspca_dev *gspca_dev)
        return val;
 }
 
-static __u8 cx_jpeg_init[][8] = {
+static const __u8 cx_jpeg_init[][8] = {
        {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x15},       /* 1 */
        {0x0f, 0x10, 0x12, 0x10, 0x0d, 0x15, 0x12, 0x11},
        {0x12, 0x18, 0x16, 0x15, 0x19, 0x20, 0x35, 0x22},
@@ -479,7 +479,7 @@ static __u8 cx_jpeg_init[][8] = {
 };
 
 
-static __u8 cxjpeg_640[][8] = {
+static const __u8 cxjpeg_640[][8] = {
        {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x10},       /* 1 */
        {0x0b, 0x0c, 0x0e, 0x0c, 0x0a, 0x10, 0x0e, 0x0d},
        {0x0e, 0x12, 0x11, 0x10, 0x13, 0x18, 0x28, 0x1a},
@@ -508,7 +508,7 @@ static __u8 cxjpeg_640[][8] = {
        {0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
        {0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}        /* 27 */
 };
-static __u8 cxjpeg_352[][8] = {
+static const __u8 cxjpeg_352[][8] = {
        {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x0d},
        {0x09, 0x09, 0x0b, 0x09, 0x08, 0x0D, 0x0b, 0x0a},
        {0x0b, 0x0e, 0x0d, 0x0d, 0x0f, 0x13, 0x1f, 0x14},
@@ -537,7 +537,7 @@ static __u8 cxjpeg_352[][8] = {
        {0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
        {0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
 };
-static __u8 cxjpeg_320[][8] = {
+static const __u8 cxjpeg_320[][8] = {
        {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x05},
        {0x03, 0x04, 0x04, 0x04, 0x03, 0x05, 0x04, 0x04},
        {0x04, 0x05, 0x05, 0x05, 0x06, 0x07, 0x0c, 0x08},
@@ -566,7 +566,7 @@ static __u8 cxjpeg_320[][8] = {
        {0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
        {0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}        /* 27 */
 };
-static __u8 cxjpeg_176[][8] = {
+static const __u8 cxjpeg_176[][8] = {
        {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x0d},
        {0x09, 0x09, 0x0B, 0x09, 0x08, 0x0D, 0x0B, 0x0A},
        {0x0B, 0x0E, 0x0D, 0x0D, 0x0F, 0x13, 0x1F, 0x14},
@@ -595,7 +595,8 @@ static __u8 cxjpeg_176[][8] = {
        {0x00, 0x01, 0x11, 0x02, 0x11, 0x00, 0x3F, 0x00},
        {0xFF, 0xD9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
 };
-static __u8 cxjpeg_qtable[][8] = {     /* 640 take with the zcx30x part */
+/* 640 take with the zcx30x part */
+static const __u8 cxjpeg_qtable[][8] = {
        {0xff, 0xd8, 0xff, 0xdb, 0x00, 0x84, 0x00, 0x08},
        {0x06, 0x06, 0x07, 0x06, 0x05, 0x08, 0x07, 0x07},
        {0x07, 0x09, 0x09, 0x08, 0x0a, 0x0c, 0x14, 0x0a},
@@ -641,22 +642,23 @@ static void cx11646_jpegInit(struct gspca_dev*gspca_dev)
        reg_w(gspca_dev->dev, 0x0055, &val, 1);
 }
 
-static __u8 reg12[] = { 0x0a, 0x05, 0x07, 0x04, 0x19 };
-static __u8 regE5_8[] = { 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };
-static __u8 regE5a[] = { 0x88, 0x0a, 0x0c, 0x01 };
-static __u8 regE5b[] = { 0x88, 0x0b, 0x12, 0x01 };
-static __u8 regE5c[] = { 0x88, 0x05, 0x01, 0x01 };
-static __u8 reg51[] = { 0x77, 0x03 };
-static __u8 reg70 = 0x03;
+static const __u8 reg12[] = { 0x0a, 0x05, 0x07, 0x04, 0x19 };
+static const __u8 regE5_8[] =
+               { 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };
+static const __u8 regE5a[] = { 0x88, 0x0a, 0x0c, 0x01 };
+static const __u8 regE5b[] = { 0x88, 0x0b, 0x12, 0x01 };
+static const __u8 regE5c[] = { 0x88, 0x05, 0x01, 0x01 };
+static const __u8 reg51[] = { 0x77, 0x03 };
+static const __u8 reg70 = 0x03;
 
 static void cx11646_jpeg(struct gspca_dev*gspca_dev)
 {
        __u8 val;
        int i;
-       int length = 8;
-       __u8 Reg55 = 0x14;
-       __u8 bufread[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
-       int retry = 50;
+       int length;
+       __u8 Reg55;
+       __u8 bufread[8];
+       int retry;
 
        val = 0x01;
        reg_w(gspca_dev->dev, 0x00c0, &val, 1);
@@ -665,6 +667,7 @@ static void cx11646_jpeg(struct gspca_dev*gspca_dev)
        val = 0x00;
        reg_w(gspca_dev->dev, 0x00c0, &val, 1);
        reg_r(gspca_dev->dev, 0x0001, &val, 1);
+       length = 8;
        switch (gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].mode) {
        case 0:
                for (i = 0; i < 27; i++) {
@@ -719,6 +722,7 @@ static void cx11646_jpeg(struct gspca_dev*gspca_dev)
        val = 0x00;
        reg_w(gspca_dev->dev, 0x0000, &val, 1);
        /* wait for completion */
+       retry = 50;
        while (retry--) {
                reg_r(gspca_dev->dev, 0x0002, &val, 1);
                                                        /* 0x07 until 0x00 */
@@ -796,8 +800,8 @@ static void cx11646_init1(struct gspca_dev *gspca_dev)
        reg_w(gspca_dev->dev, 0x003f, &val, 1);
        val = 0x40;
        reg_w(gspca_dev->dev, 0x003d, &val, 1);
-/* val= 0x60; */
-/* reg_w(gspca_dev->dev,0x00,0x00,0x003d,&val,1); */
+/*     val= 0x60; */
+/*     reg_w(gspca_dev->dev, 0x00, 0x00, 0x003d, &val, 1); */
        reg_r(gspca_dev->dev, 0x0099, &val, 1);                 /* ->0x07 */
 
        while (cx_sensor_init[i][0]) {
@@ -827,7 +831,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
        cam->cam_mode = vga_mode;
        cam->nmodes = sizeof vga_mode / sizeof vga_mode[0];
 
-       sd->qindex = 0;                 /* set the quantization table */
+       sd->qindex = 0;                 /* set the quantization */
        sd->brightness = sd_ctrls[SD_BRIGHTNESS].qctrl.default_value;
        sd->contrast = sd_ctrls[SD_CONTRAST].qctrl.default_value;
        sd->colors = sd_ctrls[SD_COLOR].qctrl.default_value;
@@ -891,7 +895,7 @@ static void sd_close(struct gspca_dev *gspca_dev)
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                        struct gspca_frame *frame,      /* target */
-                       unsigned char *data,            /* isoc packet */
+                       __u8 *data,                     /* isoc packet */
                        int len)                        /* iso packet length */
 {
        if (data[0] == 0xff && data[1] == 0xd8) {
@@ -914,21 +918,22 @@ static void setbrightness(struct gspca_dev*gspca_dev)
 {
        struct sd *sd = (struct sd *) gspca_dev;
        __u8 regE5cbx[] = { 0x88, 0x00, 0xd4, 0x01, 0x88, 0x01, 0x01, 0x01 };
-       __u8 reg51c[] = { 0x77, 0x03 };
+       __u8 reg51c[2];
        __u8 bright;
        __u8 colors;
        __u8 val;
        __u8 bufread[8];
 
        bright = sd->brightness;
-       colors = sd->colors;
        regE5cbx[2] = bright;
-       reg51c[1] = colors;
        reg_w(gspca_dev->dev, 0x00e5, regE5cbx, 8);
        reg_r(gspca_dev->dev, 0x00e8, bufread, 8);
        reg_w(gspca_dev->dev, 0x00e5, regE5c, 4);
        reg_r(gspca_dev->dev, 0x00e8, &val, 1); /* 0x00 */
 
+       colors = sd->colors;
+       reg51c[0] = 0x77;
+       reg51c[1] = colors;
        reg_w(gspca_dev->dev, 0x0051, reg51c, 2);
        reg_w(gspca_dev->dev, 0x0010, reg10, 2);
        reg_w(gspca_dev->dev, 0x0070, &reg70, 1);
@@ -938,14 +943,15 @@ static void setcontrast(struct gspca_dev*gspca_dev)
 {
        struct sd *sd = (struct sd *) gspca_dev;
        __u8 regE5acx[] = { 0x88, 0x0a, 0x0c, 0x01 };   /* seem MSB */
-       /* __u8 regE5bcx[]={0x88,0x0b,0x12,0x01}; // LSB */
-       __u8 reg51c[] = { 0x77, 0x03 };
+/*     __u8 regE5bcx[] = { 0x88, 0x0b, 0x12, 0x01};     * LSB */
+       __u8 reg51c[2];
        __u8 val;
 
-       reg51c[1] = sd->colors;
        regE5acx[2] = sd->contrast;
        reg_w(gspca_dev->dev, 0x00e5, regE5acx, 4);
        reg_r(gspca_dev->dev, 0x00e8, &val, 1); /* 0x00 */
+       reg51c[0] = 0x77;
+       reg51c[1] = sd->colors;
        reg_w(gspca_dev->dev, 0x0051, reg51c, 2);
        reg_w(gspca_dev->dev, 0x0010, reg10, 2);
        reg_w(gspca_dev->dev, 0x0070, &reg70, 1);