diff options
author | Jiri Slaby <jirislaby@gmail.com> | 2009-08-08 09:33:58 (GMT) |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-09-15 19:02:04 (GMT) |
commit | 4d62691b609cc4e66e15c8e5b2261ddb6785b7ca (patch) | |
tree | 4f2fd6544c0ede765d32b26ad7ad138fa632f5d5 /drivers | |
parent | 58c6d6d1a6ff66d81ad933cdbfbf7064a064e906 (diff) | |
download | linux-fsl-qoriq-4d62691b609cc4e66e15c8e5b2261ddb6785b7ca.tar.xz |
Staging: dream, fix buf overflow
In vfe_send_msg_no_payload there is a wrong struct vfe_message allocation.
It allocates only sizeof(pointer to vfe_message) for a whole structure.
Add a dereference to the sizeof to allocate sizeof(vfe_message).
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/staging/dream/camera/msm_vfe8x_proc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/dream/camera/msm_vfe8x_proc.c b/drivers/staging/dream/camera/msm_vfe8x_proc.c index bb65013..5436f71 100644 --- a/drivers/staging/dream/camera/msm_vfe8x_proc.c +++ b/drivers/staging/dream/camera/msm_vfe8x_proc.c @@ -818,7 +818,7 @@ static void vfe_send_msg_no_payload(enum VFE_MESSAGE_ID id) { struct vfe_message *msg; - msg = kzalloc(sizeof(msg), GFP_ATOMIC); + msg = kzalloc(sizeof(*msg), GFP_ATOMIC); if (!msg) return; |