diff options
Diffstat (limited to 'meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch')
| -rw-r--r-- | meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch b/meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch new file mode 100644 index 000000000..fac5c2171 --- /dev/null +++ b/meta-agl-bsp/meta-renesas/recipes-kernel/linux/linux/0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch @@ -0,0 +1,33 @@ +From 757d7ace565c06e1302ba7c9244d839455e13881 Mon Sep 17 00:00:00 2001 +From: Gianluca Gennari <gennarone@gmail.com> +Date: Sun, 2 Jun 2013 14:31:19 -0300 +Subject: [PATCH 3/3] [media] r820t: avoid potential memcpy buffer overflow in + shadow_store() + +The memcpy in shadow_store() could exceed buffer limits when r > 0. + +Signed-off-by: Gianluca Gennari <gennarone@gmail.com> +Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> +Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> +--- + drivers/media/tuners/r820t.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/tuners/r820t.c b/drivers/media/tuners/r820t.c +index 63062a9..0a5f96b 100644 +--- a/drivers/media/tuners/r820t.c ++++ b/drivers/media/tuners/r820t.c +@@ -364,8 +364,8 @@ static void shadow_store(struct r820t_priv *priv, u8 reg, const u8 *val, + } + if (len <= 0) + return; +- if (len > NUM_REGS) +- len = NUM_REGS; ++ if (len > NUM_REGS - r) ++ len = NUM_REGS - r; + + tuner_dbg("%s: prev reg=%02x len=%d: %*ph\n", + __func__, r + REG_SHADOW_START, len, len, val); +-- +2.9.2 + |