]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/commit
bcm2835-v4l2: Fix buffer overflow problem
authorDave Stevenson <dave.stevenson@raspberrypi.org>
Fri, 10 Mar 2017 14:43:15 +0000 (14:43 +0000)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Tue, 19 Sep 2017 10:07:53 +0000 (12:07 +0200)
commit37c459e9dbc9b0809511d86f46b63b7c8994799d
treeada89ca5843253f34df50a792136329ea9f006ff
parentea13df51421fe2072b3fc243e9a0b03e28661d0a
bcm2835-v4l2: Fix buffer overflow problem

https://github.com/raspberrypi/linux/issues/1447
port_parameter_get() failed to account for the header
(u32 id and u32 size) in the size before memcpying
the response into the response buffer, so overrunning
the provided buffer by 8 bytes.

Account for those bytes, and also a belt-and-braces
check to ensure we never copy more than *value_size
bytes into value.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
drivers/media/platform/bcm2835/mmal-vchiq.c