* [PATCH] media: dw2102: fix a potential buffer overflow
@ 2024-04-29 14:17 Mauro Carvalho Chehab
2024-04-29 14:24 ` Hans Verkuil
0 siblings, 1 reply; 2+ messages in thread
From: Mauro Carvalho Chehab @ 2024-04-29 14:17 UTC (permalink / raw)
Cc: Mauro Carvalho Chehab, Hans Verkuil, Hans Verkuil, Michael Bunk,
Wei Chen, Yu Zhe, Zhang Shurong, linux-kernel, linux-media
As pointed by smatch:
drivers/media/usb/dvb-usb/dw2102.c:802 su3000_i2c_transfer() error: __builtin_memcpy() '&state->data[4]' too small (64 vs 67)
That seemss to be due to a wrong copy-and-paste.
Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
---
drivers/media/usb/dvb-usb/dw2102.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 03b411ad64bb..79e2ccf974c9 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -789,7 +789,7 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
if (msg[j].flags & I2C_M_RD) {
/* single read */
- if (1 + msg[j].len > sizeof(state->data)) {
+ if (4 + msg[j].len > sizeof(state->data)) {
warn("i2c rd: len=%d is too big!\n", msg[j].len);
num = -EOPNOTSUPP;
break;
--
2.44.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] media: dw2102: fix a potential buffer overflow
2024-04-29 14:17 [PATCH] media: dw2102: fix a potential buffer overflow Mauro Carvalho Chehab
@ 2024-04-29 14:24 ` Hans Verkuil
0 siblings, 0 replies; 2+ messages in thread
From: Hans Verkuil @ 2024-04-29 14:24 UTC (permalink / raw)
To: Mauro Carvalho Chehab
Cc: Hans Verkuil, Michael Bunk, Wei Chen, Yu Zhe, Zhang Shurong,
linux-kernel, linux-media
On 29/04/2024 16:17, Mauro Carvalho Chehab wrote:
> As pointed by smatch:
> drivers/media/usb/dvb-usb/dw2102.c:802 su3000_i2c_transfer() error: __builtin_memcpy() '&state->data[4]' too small (64 vs 67)
>
> That seemss to be due to a wrong copy-and-paste.
>
> Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
Regards,
Hans
> ---
> drivers/media/usb/dvb-usb/dw2102.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
> index 03b411ad64bb..79e2ccf974c9 100644
> --- a/drivers/media/usb/dvb-usb/dw2102.c
> +++ b/drivers/media/usb/dvb-usb/dw2102.c
> @@ -789,7 +789,7 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
>
> if (msg[j].flags & I2C_M_RD) {
> /* single read */
> - if (1 + msg[j].len > sizeof(state->data)) {
> + if (4 + msg[j].len > sizeof(state->data)) {
> warn("i2c rd: len=%d is too big!\n", msg[j].len);
> num = -EOPNOTSUPP;
> break;
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-04-29 14:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-04-29 14:17 [PATCH] media: dw2102: fix a potential buffer overflow Mauro Carvalho Chehab
2024-04-29 14:24 ` Hans Verkuil
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®