lkml.org 
[lkml]   [2019]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 202/350] media: rcar_drif: fix a memory disclosure
    Date
    From: Kangjie Lu <kjlu@umn.edu>

    [ Upstream commit d39083234c60519724c6ed59509a2129fd2aed41 ]

    "f->fmt.sdr.reserved" is uninitialized. As other peer drivers
    like msi2500 and airspy do, the fix initializes it to avoid
    memory disclosures.

    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/platform/rcar_drif.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c
    index 608e5217ccd50..0f267a237b424 100644
    --- a/drivers/media/platform/rcar_drif.c
    +++ b/drivers/media/platform/rcar_drif.c
    @@ -912,6 +912,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv,
    {
    struct rcar_drif_sdr *sdr = video_drvdata(file);

    + memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved));
    f->fmt.sdr.pixelformat = sdr->fmt->pixelformat;
    f->fmt.sdr.buffersize = sdr->fmt->buffersize;

    --
    2.20.1
    \
     
     \ /
      Last update: 2019-12-10 22:24    [W:2.190 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site