mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-02 09:51:21 -04:00
Code Issues Packages Projects Releases Wiki Activity

media: atomisp: Fix buffer overrun in gmin_get_var_int()

Browse Source 
Not all functions used in gmin_get_var_int() update len to the actual
length of the returned string. So len may still have its initial value
of the length of val[] when "val[len] = 0;" is run to ensure 0 termination.

If this happens we end up writing one beyond the bounds of val[], fix this.

Note this is a quick fix for this since the entirety of
atomisp_gmin_platform.c will be removed once all atomisp sensor
drivers have been moved over to runtime-pm + v4l2-async device
registration.

Closes: https://lore.kernel.org/linux-media/26f37e19-c240-4d77-831d-ef3f1a4dd51d@kili.mountain/

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
This commit is contained in:
Hans de Goede
2023-05-27 16:38:12 +01:00
committed by Mauro Carvalho Chehab
parent 1657f2934d
commit fadac6afcc
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
View File

@@ -1429,8 +1429,8 @@ static int gmin_get_config_var(struct device *maindev,
int gmin_get_var_int(struct device *dev, bool is_gmin, const char *var, int def)
{
char val[CFG_VAR_NAME_MAX];
size_t len = sizeof(val);
char val[CFG_VAR_NAME_MAX + 1];
size_t len = CFG_VAR_NAME_MAX;
long result;
int ret;