diff options
| author | Mauro Carvalho Chehab <mchehab@kernel.org> | 2024-04-29 15:15:05 +0100 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@kernel.org> | 2024-04-29 19:04:03 +0100 |
| commit | 1c73d0b29d04bf4082e7beb6a508895e118ee30d (patch) | |
| tree | 20d7dc716c7abd064c8aada35e602ff1ddd0b578 /drivers/media/usb | |
| parent | 9789ea6ab6868ef59062de867cc6a62ccbf49703 (diff) | |
| download | linux-stable-1c73d0b29d04bf4082e7beb6a508895e118ee30d.tar.gz linux-stable-1c73d0b29d04bf4082e7beb6a508895e118ee30d.tar.bz2 linux-stable-1c73d0b29d04bf4082e7beb6a508895e118ee30d.zip | |
media: dw2102: fix a potential buffer overflow
As pointed by smatch:
drivers/media/usb/dvb-usb/dw2102.c:802 su3000_i2c_transfer() error: __builtin_memcpy() '&state->data[4]' too small (64 vs 67)
That seemss to be due to a wrong copy-and-paste.
Fixes: 0e148a522b84 ("media: dw2102: Don't translate i2c read into write")
Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Diffstat (limited to 'drivers/media/usb')
| -rw-r--r-- | drivers/media/usb/dvb-usb/dw2102.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c index 03b411ad64bb..79e2ccf974c9 100644 --- a/drivers/media/usb/dvb-usb/dw2102.c +++ b/drivers/media/usb/dvb-usb/dw2102.c @@ -789,7 +789,7 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], if (msg[j].flags & I2C_M_RD) { /* single read */ - if (1 + msg[j].len > sizeof(state->data)) { + if (4 + msg[j].len > sizeof(state->data)) { warn("i2c rd: len=%d is too big!\n", msg[j].len); num = -EOPNOTSUPP; break; |