[PATCH] Fix oops in video_register_device

degerrit@web.de wrote:
   "I caused an oops in unusual circumstances by accidentally "forcing" a
    video device number which was too high or already taken (don't know
    which). I assume this probably shouldn't give an oops (though it was my
     fault), so here's a bugreport..."

Fixed by adding a range check for the number passed in by the driver.

drivers/media/video/videodev.c

@@ -316,7 +316,14 @@ int video_register_device(struct video_device *vfd, int type, int nr)
 
 	/* pick a minor number */
 	down(&videodev_lock);
-	if (-1 == nr) {
+	if (nr >= 0  &&  nr < end-base) {
+		/* use the one the driver asked for */
+		i = base+nr;
+		if (NULL != video_device[i]) {
+			up(&videodev_lock);
+			return -ENFILE;
+		}
+	} else {
 		/* use first free */
 		for(i=base;i<end;i++)
 			if (NULL == video_device[i])
@@ -325,13 +332,6 @@ int video_register_device(struct video_device *vfd, int type, int nr)
 			up(&videodev_lock);
 			return -ENFILE;
 		}
-	} else {
-		/* use the one the driver asked for */
-		i = base+nr;
-		if (NULL != video_device[i]) {
-			up(&videodev_lock);
-			return -ENFILE;
-		}
 	}
 	video_device[i]=vfd;
 	vfd->minor=i;