OSDN Git Service

bcm2835-v4l2: Fix buffer overflow problem
authorDave Stevenson <dave.stevenson@raspberrypi.org>
Tue, 14 Mar 2017 15:10:40 +0000 (08:10 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 21 Mar 2017 07:38:33 +0000 (08:38 +0100)
commitf7d51372d7d1779bf60f7de35a4b12850442a9de
tree78d4f4beb75ea48a8bb8dd2ab33619207651a4a6
parentce95e3a9c59916d248df0a1a80494969777565df
bcm2835-v4l2: Fix buffer overflow problem

https://github.com/raspberrypi/linux/issues/1447
port_parameter_get() failed to account for the header
(u32 id and u32 size) in the size before memcpying
the response into the response buffer, so overrunning
the provided buffer by 8 bytes.

Account for those bytes, and also a belt-and-braces
check to ensure we never copy more than *value_size
bytes into value.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Signed-off-by: Michael Zoran <mzoran@crowfest.net>
Tested-by: Michael Zoran <mzoran@crowfest.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c