[media] dvb: si21xx: buffer overflow in si21_writeregs()
"len" is user controlled and can be up to 255. Anything more than 59 will cause a buffer overflow so we need to add a test for that. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This commit is contained in:
parent
e947d9ad8a
commit
cf3b576d52
|
@ -236,6 +236,9 @@ static int si21_writeregs(struct si21xx_state *state, u8 reg1,
|
||||||
.len = len + 1
|
.len = len + 1
|
||||||
};
|
};
|
||||||
|
|
||||||
|
if (len > sizeof(buf) - 1)
|
||||||
|
return -EINVAL;
|
||||||
|
|
||||||
msg.buf[0] = reg1;
|
msg.buf[0] = reg1;
|
||||||
memcpy(msg.buf + 1, data, len);
|
memcpy(msg.buf + 1, data, len);
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue