aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/media/video
diff options
context:
space:
mode:
authorAlexey Dobriyan <adobriyan@gmail.com>2007-01-14 13:29:42 -0500
committerMauro Carvalho Chehab <mchehab@infradead.org>2007-02-21 10:34:35 -0500
commit13071f0a58f285eee81f63c917078bb2a48cf51e (patch)
tree03716b21d5594b84a6b11a253628435068de92a1 /drivers/media/video
parentc74e0062684bc034a003289e2e2023f0e9ff747c (diff)
V4L/DVB (5076): Cpia.c: buffer overflow
If assigned minor is 10 or greater, terminator will be put beyound the end. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Diffstat (limited to 'drivers/media/video')
-rw-r--r--drivers/media/video/cpia.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/media/video/cpia.c b/drivers/media/video/cpia.c
index 735a52a9041a..78c9699eafbb 100644
--- a/drivers/media/video/cpia.c
+++ b/drivers/media/video/cpia.c
@@ -1350,13 +1350,13 @@ out:
1350 1350
1351static void create_proc_cpia_cam(struct cam_data *cam) 1351static void create_proc_cpia_cam(struct cam_data *cam)
1352{ 1352{
1353 char name[7]; 1353 char name[5 + 1 + 10 + 1];
1354 struct proc_dir_entry *ent; 1354 struct proc_dir_entry *ent;
1355 1355
1356 if (!cpia_proc_root || !cam) 1356 if (!cpia_proc_root || !cam)
1357 return; 1357 return;
1358 1358
1359 sprintf(name, "video%d", cam->vdev.minor); 1359 snprintf(name, sizeof(name), "video%d", cam->vdev.minor);
1360 1360
1361 ent = create_proc_entry(name, S_IFREG|S_IRUGO|S_IWUSR, cpia_proc_root); 1361 ent = create_proc_entry(name, S_IFREG|S_IRUGO|S_IWUSR, cpia_proc_root);
1362 if (!ent) 1362 if (!ent)
@@ -1376,12 +1376,12 @@ static void create_proc_cpia_cam(struct cam_data *cam)
1376 1376
1377static void destroy_proc_cpia_cam(struct cam_data *cam) 1377static void destroy_proc_cpia_cam(struct cam_data *cam)
1378{ 1378{
1379 char name[7]; 1379 char name[5 + 1 + 10 + 1];
1380 1380
1381 if (!cam || !cam->proc_entry) 1381 if (!cam || !cam->proc_entry)
1382 return; 1382 return;
1383 1383
1384 sprintf(name, "video%d", cam->vdev.minor); 1384 snprintf(name, sizeof(name), "video%d", cam->vdev.minor);
1385 remove_proc_entry(name, cpia_proc_root); 1385 remove_proc_entry(name, cpia_proc_root);
1386 cam->proc_entry = NULL; 1386 cam->proc_entry = NULL;
1387} 1387}