diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-04-13 05:32:15 -0400 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2013-06-12 17:52:45 -0400 |
commit | c88e739b1fad662240e99ecbd0bdaac871717987 (patch) | |
tree | d4534b04e1d1671fa55b39bac18e72cbb527c9d4 | |
parent | fe905b8cc992edd3d1f729f4a88c4701e7c3b774 (diff) |
[media] media: info leak in __media_device_enum_links()
These structs have holes and reserved struct members which aren't
cleared. I've added a memset() so we don't leak stack information.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
-rw-r--r-- | drivers/media/media-device.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c index 1957c0df08fd..d5a7a135f75d 100644 --- a/drivers/media/media-device.c +++ b/drivers/media/media-device.c | |||
@@ -142,6 +142,8 @@ static long __media_device_enum_links(struct media_device *mdev, | |||
142 | 142 | ||
143 | for (p = 0; p < entity->num_pads; p++) { | 143 | for (p = 0; p < entity->num_pads; p++) { |
144 | struct media_pad_desc pad; | 144 | struct media_pad_desc pad; |
145 | |||
146 | memset(&pad, 0, sizeof(pad)); | ||
145 | media_device_kpad_to_upad(&entity->pads[p], &pad); | 147 | media_device_kpad_to_upad(&entity->pads[p], &pad); |
146 | if (copy_to_user(&links->pads[p], &pad, sizeof(pad))) | 148 | if (copy_to_user(&links->pads[p], &pad, sizeof(pad))) |
147 | return -EFAULT; | 149 | return -EFAULT; |
@@ -159,6 +161,7 @@ static long __media_device_enum_links(struct media_device *mdev, | |||
159 | if (entity->links[l].source->entity != entity) | 161 | if (entity->links[l].source->entity != entity) |
160 | continue; | 162 | continue; |
161 | 163 | ||
164 | memset(&link, 0, sizeof(link)); | ||
162 | media_device_kpad_to_upad(entity->links[l].source, | 165 | media_device_kpad_to_upad(entity->links[l].source, |
163 | &link.source); | 166 | &link.source); |
164 | media_device_kpad_to_upad(entity->links[l].sink, | 167 | media_device_kpad_to_upad(entity->links[l].sink, |