aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/media/video/se401.c
diff options
context:
space:
mode:
authorAlan Cox <alan@linux.intel.com>2009-06-11 10:04:11 -0400
committerMauro Carvalho Chehab <mchehab@redhat.com>2009-06-16 18:07:37 -0400
commit6f4d72392d76b8f78f646805ba2be995b3f77992 (patch)
tree3ba94153bab59537a0f9215b6fc1878ba9923288 /drivers/media/video/se401.c
parent5e2c217eee18a4627a32c49f57f47dbac67dcf23 (diff)
V4L/DVB (11959): se401: Fix unsafe use of sprintf with identical source/destination
Closes-bug: http://bugzilla.kernel.org/show_bug.cgi?id=13435 Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Douglas Schilling Landgraf <dougsland@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video/se401.c')
-rw-r--r--drivers/media/video/se401.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/media/video/se401.c b/drivers/media/video/se401.c
index 5990ab38a124..08129a830d6e 100644
--- a/drivers/media/video/se401.c
+++ b/drivers/media/video/se401.c
@@ -1244,17 +1244,18 @@ static int se401_init(struct usb_se401 *se401, int button)
1244 int i=0, rc; 1244 int i=0, rc;
1245 unsigned char cp[0x40]; 1245 unsigned char cp[0x40];
1246 char temp[200]; 1246 char temp[200];
1247 int slen;
1247 1248
1248 /* led on */ 1249 /* led on */
1249 se401_sndctrl(1, se401, SE401_REQ_LED_CONTROL, 1, NULL, 0); 1250 se401_sndctrl(1, se401, SE401_REQ_LED_CONTROL, 1, NULL, 0);
1250 1251
1251 /* get camera descriptor */ 1252 /* get camera descriptor */
1252 rc=se401_sndctrl(0, se401, SE401_REQ_GET_CAMERA_DESCRIPTOR, 0, cp, sizeof(cp)); 1253 rc=se401_sndctrl(0, se401, SE401_REQ_GET_CAMERA_DESCRIPTOR, 0, cp, sizeof(cp));
1253 if (cp[1]!=0x41) { 1254 if (cp[1] != 0x41) {
1254 err("Wrong descriptor type"); 1255 err("Wrong descriptor type");
1255 return 1; 1256 return 1;
1256 } 1257 }
1257 sprintf (temp, "ExtraFeatures: %d", cp[3]); 1258 slen = snprintf(temp, 200, "ExtraFeatures: %d", cp[3]);
1258 1259
1259 se401->sizes=cp[4]+cp[5]*256; 1260 se401->sizes=cp[4]+cp[5]*256;
1260 se401->width=kmalloc(se401->sizes*sizeof(int), GFP_KERNEL); 1261 se401->width=kmalloc(se401->sizes*sizeof(int), GFP_KERNEL);
@@ -1269,9 +1270,10 @@ static int se401_init(struct usb_se401 *se401, int button)
1269 se401->width[i]=cp[6+i*4+0]+cp[6+i*4+1]*256; 1270 se401->width[i]=cp[6+i*4+0]+cp[6+i*4+1]*256;
1270 se401->height[i]=cp[6+i*4+2]+cp[6+i*4+3]*256; 1271 se401->height[i]=cp[6+i*4+2]+cp[6+i*4+3]*256;
1271 } 1272 }
1272 sprintf (temp, "%s Sizes:", temp); 1273 slen += snprintf (temp + slen, 200 - slen, " Sizes:");
1273 for (i=0; i<se401->sizes; i++) { 1274 for (i=0; i<se401->sizes; i++) {
1274 sprintf(temp, "%s %dx%d", temp, se401->width[i], se401->height[i]); 1275 slen += snprintf(temp + slen, 200 - slen,
1276 " %dx%d", se401->width[i], se401->height[i]);
1275 } 1277 }
1276 dev_info(&se401->dev->dev, "%s\n", temp); 1278 dev_info(&se401->dev->dev, "%s\n", temp);
1277 se401->maxframesize=se401->width[se401->sizes-1]*se401->height[se401->sizes-1]*3; 1279 se401->maxframesize=se401->width[se401->sizes-1]*se401->height[se401->sizes-1]*3;