redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

[media] dvb: si21xx: buffer overflow in si21_writeregs()

Browse source 
"len" is user controlled and can be up to 255.  Anything more than 59
will cause a buffer overflow so we need to add a test for that.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This commit is contained in:
Dan Carpenter 2014-09-09 09:05:28 -03:00 committed by Mauro Carvalho Chehab
parent e947d9ad8a
commit cf3b576d52
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/media/dvb-frontends/si21xx.c
View file

@ -236,6 +236,9 @@ static int si21_writeregs(struct si21xx_state *state, u8 reg1,
.len = len + 1
};
if (len > sizeof(buf) - 1)
return -EINVAL;
msg.buf[0] = reg1;
memcpy(msg.buf + 1, data, len);