aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGianluca Gennari <gennarone@gmail.com>2013-06-02 13:31:19 -0400
committerMichael Krufky <mkrufky@linuxtv.org>2013-06-17 19:28:18 -0400
commit75931eba5a94461c430a4fb4110cf26222265bda (patch)
tree4a616faf99b08c49d8d9f7a264c642e262aaed0a
parent6de8e7c3a4e439f50abc93a625d207b7d77c5c48 (diff)
r820t: avoid potential memcpy buffer overflow in shadow_store()
The memcpy in shadow_store() could exceed buffer limits when r > 0. Signed-off-by: Gianluca Gennari <gennarone@gmail.com> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
-rw-r--r--drivers/media/tuners/r820t.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/tuners/r820t.c b/drivers/media/tuners/r820t.c
index 63062a9b4003..0a5f96be08f1 100644
--- a/drivers/media/tuners/r820t.c
+++ b/drivers/media/tuners/r820t.c
@@ -364,8 +364,8 @@ static void shadow_store(struct r820t_priv *priv, u8 reg, const u8 *val,
}
if (len <= 0)
return;
- if (len > NUM_REGS)
- len = NUM_REGS;
+ if (len > NUM_REGS - r)
+ len = NUM_REGS - r;
tuner_dbg("%s: prev reg=%02x len=%d: %*ph\n",
__func__, r + REG_SHADOW_START, len, len, val);

Privacy Policy