FEX-Emu/linux
1
0
Fork 0
mirror of https://github.com/FEX-Emu/linux.git synced 2024-12-23 18:07:03 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[media] dvb: si21xx: buffer overflow in si21_writeregs()

Browse Source 
"len" is user controlled and can be up to 255.  Anything more than 59
will cause a buffer overflow so we need to add a test for that.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This commit is contained in:
Dan Carpenter 2014-09-09 09:05:28 -03:00 committed by Mauro Carvalho Chehab
parent e947d9ad8a
commit cf3b576d52
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/media/dvb-frontends/si21xx.c
View File

@ -236,6 +236,9 @@ static int si21_writeregs(struct si21xx_state *state, u8 reg1,
.len = len + 1
};
if (len > sizeof(buf) - 1)
return -EINVAL;
msg.buf[0] = reg1;
memcpy(msg.buf + 1, data, len);