rcar-gen2: linux-renesas: backport r820t tuner driver to fix SPEC-418
[AGL/meta-agl.git] / meta-agl-bsp / meta-renesas / recipes-kernel / linux / linux / 0003-media-r820t-avoid-potential-memcpy-buffer-overflow-i.patch
1 From 757d7ace565c06e1302ba7c9244d839455e13881 Mon Sep 17 00:00:00 2001
2 From: Gianluca Gennari <gennarone@gmail.com>
3 Date: Sun, 2 Jun 2013 14:31:19 -0300
4 Subject: [PATCH 3/3] [media] r820t: avoid potential memcpy buffer overflow in
5  shadow_store()
6
7 The memcpy in shadow_store() could exceed buffer limits when r > 0.
8
9 Signed-off-by: Gianluca Gennari <gennarone@gmail.com>
10 Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
11 Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
12 ---
13  drivers/media/tuners/r820t.c | 4 ++--
14  1 file changed, 2 insertions(+), 2 deletions(-)
15
16 diff --git a/drivers/media/tuners/r820t.c b/drivers/media/tuners/r820t.c
17 index 63062a9..0a5f96b 100644
18 --- a/drivers/media/tuners/r820t.c
19 +++ b/drivers/media/tuners/r820t.c
20 @@ -364,8 +364,8 @@ static void shadow_store(struct r820t_priv *priv, u8 reg, const u8 *val,
21         }
22         if (len <= 0)
23                 return;
24 -       if (len > NUM_REGS)
25 -               len = NUM_REGS;
26 +       if (len > NUM_REGS - r)
27 +               len = NUM_REGS - r;
28  
29         tuner_dbg("%s: prev  reg=%02x len=%d: %*ph\n",
30                   __func__, r + REG_SHADOW_START, len, len, val);
31 -- 
32 2.9.2
33