OSDN Git Service
(root)
/
uclinux-h8
/
linux.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
ff05cf0
)
media: winbond-cir: buffer overrun during transmit
author
Sean Young
<sean@mess.org>
Fri, 4 Aug 2017 10:33:41 +0000
(06:33 -0400)
committer
Mauro Carvalho Chehab
<mchehab@s-opensource.com>
Sun, 20 Aug 2017 13:52:04 +0000
(09:52 -0400)
We're reading beyond the buffer before checking its length.
BUG: KASAN: slab-out-of-bounds in wbcir_irq_tx
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
drivers/media/rc/winbond-cir.c
patch
|
blob
|
history
diff --git
a/drivers/media/rc/winbond-cir.c
b/drivers/media/rc/winbond-cir.c
index
ea7be6d
..
a18eb23
100644
(file)
--- a/
drivers/media/rc/winbond-cir.c
+++ b/
drivers/media/rc/winbond-cir.c
@@
-429,7
+429,7
@@
wbcir_irq_tx(struct wbcir_data *data)
bytes[used] = byte;
}
- while (data->tx
buf[data->txoff] == 0 && data->txoff != data->txlen
)
+ while (data->tx
off != data->txlen && data->txbuf[data->txoff] == 0
)
data->txoff++;
if (used == 0) {