diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2014-09-09 09:11:23 -0300 |
|---|---|---|
| committer |   Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2014-09-23 16:13:39 -0300 |
| commit | 7ac95cf59d59473e680937319594ce0719497e98 (patch) | |
| tree | b7cb5b002d0e71aacb17868f228d880cf8d5a2cb /drivers/media/v4l2-core/v4l2-common.c | |
| parent | [media] dvb: si21xx: buffer overflow in si21_writeregs() (diff) | |
| download | linux-rng-7ac95cf59d59473e680937319594ce0719497e98.tar.xz linux-rng-7ac95cf59d59473e680937319594ce0719497e98.zip | |
[media] firewire: firedtv-avc: fix more potential buffer overflow
"program_info_length" is user controlled and can go up to 4095. The
operand[] array has 509 bytes so we need to add a limit here to prevent
buffer overflows.
The " - 4" in the limit check is because we have 4 bytes more data to
add after the memcpy().
[mchehab@osg.samsung.com: as I merged the version 1 of the patch, I needed
to rebase to apply just the differences between v1 and v2]
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media/v4l2-core/v4l2-common.c')
0 files changed, 0 insertions, 0 deletions