diff options
author | Gianluca Gennari <gennarone@gmail.com> | 2013-06-02 17:31:19 (GMT) |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2013-06-19 14:07:44 (GMT) |
commit | 757d7ace565c06e1302ba7c9244d839455e13881 (patch) | |
tree | 307d2f96f010575be995e2d1274b9cabf2debd46 /drivers/media | |
parent | e2e324d70defce7ffc4668085dc3c8ae580074e5 (diff) | |
download | linux-fsl-qoriq-757d7ace565c06e1302ba7c9244d839455e13881.tar.xz |
[media] r820t: avoid potential memcpy buffer overflow in shadow_store()
The memcpy in shadow_store() could exceed buffer limits when r > 0.
Signed-off-by: Gianluca Gennari <gennarone@gmail.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
-rw-r--r-- | drivers/media/tuners/r820t.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/tuners/r820t.c b/drivers/media/tuners/r820t.c index 63062a9..0a5f96b 100644 --- a/drivers/media/tuners/r820t.c +++ b/drivers/media/tuners/r820t.c @@ -364,8 +364,8 @@ static void shadow_store(struct r820t_priv *priv, u8 reg, const u8 *val, } if (len <= 0) return; - if (len > NUM_REGS) - len = NUM_REGS; + if (len > NUM_REGS - r) + len = NUM_REGS - r; tuner_dbg("%s: prev reg=%02x len=%d: %*ph\n", __func__, r + REG_SHADOW_START, len, len, val); |