diff options
| author | Dave Stevenson <dave.stevenson@raspberrypi.org> | 2017-03-14 08:10:40 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-03-21 08:38:33 +0100 |
| commit | f7d51372d7d1779bf60f7de35a4b12850442a9de (patch) | |
| tree | 78d4f4beb75ea48a8bb8dd2ab33619207651a4a6 /drivers/staging/vc04_services/bcm2835-audio | |
| parent | ce95e3a9c59916d248df0a1a80494969777565df (diff) | |
| download | op-kernel-dev-f7d51372d7d1779bf60f7de35a4b12850442a9de.zip op-kernel-dev-f7d51372d7d1779bf60f7de35a4b12850442a9de.tar.gz | |
bcm2835-v4l2: Fix buffer overflow problem
https://github.com/raspberrypi/linux/issues/1447
port_parameter_get() failed to account for the header
(u32 id and u32 size) in the size before memcpying
the response into the response buffer, so overrunning
the provided buffer by 8 bytes.
Account for those bytes, and also a belt-and-braces
check to ensure we never copy more than *value_size
bytes into value.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Signed-off-by: Michael Zoran <mzoran@crowfest.net>
Tested-by: Michael Zoran <mzoran@crowfest.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/vc04_services/bcm2835-audio')
0 files changed, 0 insertions, 0 deletions
