![]() This updated patch also fixes out of bound access to b[]. In dib9000_risc_apb_access_write() an out of bound access to mb[]. The current test to avoid out of bound access to mb[] is insufficient. For len = 19 non-existent mb[10] will be accessed. For odd values of len b[] is accessed out of bounds. For large values of len an of bound access to mb[] may occur in dib9000_mbx_send_attr. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com> |
||
---|---|---|
.. | ||
common | ||
dvb-core | ||
dvb-frontends | ||
firewire | ||
i2c | ||
mmc | ||
parport | ||
pci | ||
platform | ||
radio | ||
rc | ||
tuners | ||
usb | ||
v4l2-core | ||
Kconfig | ||
Makefile | ||
media-device.c | ||
media-devnode.c | ||
media-entity.c |