aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHans Verkuil <hverkuil@xs4all.nl>2016-07-22 08:36:29 (GMT)
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2016-07-28 23:16:35 (GMT)
commit292eaf50c7df4ae2ae8aaa9e1ce3f1240a353ee8 (patch)
tree2f15beb3e5ff2268fda5c96b62916a2d3ee6701e
parentcd70c37b5a23eee7aa411205e2b4c74097f52336 (diff)
[media] cec: fix off-by-one memsetmedia/v4.8-5
The unused bytes of the features array should be zeroed, but the start index was one byte too early. This caused the device features byte to be overwritten by 0. The compliance test for the CEC_S_LOG_ADDRS ioctl didn't catch this because it tested byte continuation with the second device features byte being 0 :-( Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
-rw-r--r--drivers/staging/media/cec/cec-adap.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/media/cec/cec-adap.c b/drivers/staging/media/cec/cec-adap.c
index 9fffddb..b2393bba 100644
--- a/drivers/staging/media/cec/cec-adap.c
+++ b/drivers/staging/media/cec/cec-adap.c
@@ -1252,7 +1252,7 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
return -EINVAL;
}
/* Zero unused part of the feature array */
- memset(features + i, 0, feature_sz - i);
+ memset(features + i + 1, 0, feature_sz - i - 1);
}
if (log_addrs->cec_version >= CEC_OP_CEC_VERSION_2_0) {

Privacy Policy