redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

[media] cec: fix off-by-one memset 

The unused bytes of the features array should be zeroed, but the start index was one
byte too early. This caused the device features byte to be overwritten by 0.

The compliance test for the CEC_S_LOG_ADDRS ioctl didn't catch this because it tested
byte continuation with the second device features byte being 0 :-(

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
hifive-unleashed-5.1
Hans Verkuil 2016-07-22 05:36:29 -03:00 committed by Mauro Carvalho Chehab
parent cd70c37b5a
commit 292eaf50c7
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/staging/media/cec/cec-adap.c
View File

@ -1252,7 +1252,7 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
return -EINVAL;
}
/* Zero unused part of the feature array */
memset(features + i, 0, feature_sz - i);
memset(features + i + 1, 0, feature_sz - i - 1);
}
if (log_addrs->cec_version >= CEC_OP_CEC_VERSION_2_0) {