V4L/DVB: Fix case where fields were not at the correct start location

This patch address an arithmetic error for the case where the only remaining
content in the USB packet was the "225Axxxx" start of active video.  In cases
where that happened to be at the end of the frame, we would inject it into the
videobuf (which is incorrect).  This caused fields to be intermittently
rendered off by two pixels.

Thanks to Eugeniy Meshcheryakov for bringing this issue to my attention

Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 20090e34173a617c8cd6030124948f2110533917..7b9ec6e493e4ee43b5534326f6b0c43ed126df7f 100644 (file)
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -654,12 +654,12 @@ static inline int em28xx_isoc_copy_vbi(struct em28xx *dev, struct urb *urb)
                }
 
                if (buf != NULL && dev->capture_type == 2) {
-                       if (len > 4 && p[0] == 0x88 && p[1] == 0x88 &&
+                       if (len >= 4 && p[0] == 0x88 && p[1] == 0x88 &&
                            p[2] == 0x88 && p[3] == 0x88) {
                                p += 4;
                                len -= 4;
                        }
-                       if (len > 4 && p[0] == 0x22 && p[1] == 0x5a) {
+                       if (len >= 4 && p[0] == 0x22 && p[1] == 0x5a) {
                                em28xx_isocdbg("Video frame %d, len=%i, %s\n",
                                               p[2], len, (p[2] & 1) ?
                                               "odd" : "even");