diff options
| author | Sean Young <sean@mess.org> | 2017-08-04 06:33:41 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2017-08-20 09:52:04 -0400 |
| commit | 4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3 (patch) | |
| tree | c65bb10255e99db2865e74a188ee9e94356efdee /drivers/media/rc | |
| parent | ff05cf0937ad9c88bcfffd5d871918dc1827d989 (diff) | |
| download | op-kernel-dev-4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3.zip op-kernel-dev-4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3.tar.gz | |
media: winbond-cir: buffer overrun during transmit
We're reading beyond the buffer before checking its length.
BUG: KASAN: slab-out-of-bounds in wbcir_irq_tx
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/rc')
| -rw-r--r-- | drivers/media/rc/winbond-cir.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c index ea7be6d..a18eb23 100644 --- a/drivers/media/rc/winbond-cir.c +++ b/drivers/media/rc/winbond-cir.c @@ -429,7 +429,7 @@ wbcir_irq_tx(struct wbcir_data *data) bytes[used] = byte; } - while (data->txbuf[data->txoff] == 0 && data->txoff != data->txlen) + while (data->txoff != data->txlen && data->txbuf[data->txoff] == 0) data->txoff++; if (used == 0) { |
