diff options
author | 2017-01-24 16:38:38 +0900 | |
---|---|---|
committer | 2017-01-24 15:12:50 +0000 | |
commit | 6963084e3bcfb8e8d6c59e2d18a8f584888fdb79 (patch) | |
tree | 09e15516c7e60c14cf7998cfd4169213b6f2f922 /meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch | |
parent | 0540b982fc5547951ac55427206c8b3a810ef3a5 (diff) |
rcar-gen2: linux-renesas: backport r820t tuner driver to fix SPEC-418
Fix the issue that radio app using r820t tuner driver some times crash.
Bug-AGL: SPEC-418
Change-Id: I1529ecba91c3988eea6b271d5f8ce6d2d8f1bb11
Signed-off-by: Harunobu Kurokawa <harunobu.kurokawa.dn@renesas.com>
Diffstat (limited to 'meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch')
-rw-r--r-- | meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch b/meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch new file mode 100644 index 000000000..fac5c2171 --- /dev/null +++ b/meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch @@ -0,0 +1,33 @@ +From 757d7ace565c06e1302ba7c9244d839455e13881 Mon Sep 17 00:00:00 2001 +From: Gianluca Gennari <gennarone@gmail.com> +Date: Sun, 2 Jun 2013 14:31:19 -0300 +Subject: [PATCH 3/3] [media] r820t: avoid potential memcpy buffer overflow in + shadow_store() + +The memcpy in shadow_store() could exceed buffer limits when r > 0. + +Signed-off-by: Gianluca Gennari <gennarone@gmail.com> +Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +--- + drivers/media/tuners/r820t.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/tuners/r820t.c b/drivers/media/tuners/r820t.c +index 63062a9..0a5f96b 100644 +--- a/drivers/media/tuners/r820t.c ++++ b/drivers/media/tuners/r820t.c +@@ -364,8 +364,8 @@ static void shadow_store(struct r820t_priv *priv, u8 reg, const u8 *val, + } + if (len <= 0) + return; +- if (len > NUM_REGS) +- len = NUM_REGS; ++ if (len > NUM_REGS - r) ++ len = NUM_REGS - r; + + tuner_dbg("%s: prev reg=%02x len=%d: %*ph\n", + __func__, r + REG_SHADOW_START, len, len, val); +-- +2.9.2 + |