aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/media
diff options
context:
space:
mode:
authorFlorin Malita <fmalita@gmail.com>2007-10-15 11:59:18 -0400
committerMauro Carvalho Chehab <mchehab@infradead.org>2007-10-22 10:01:49 -0400
commite7222ca9b4e6c6cdabedd8d33da59263ace85a02 (patch)
tree4be415d5c0c9d770543c464ff2b2540542a7cba5 /drivers/media
parent2f7362ef9bc9c41436c7f44212a2dcf12dddffbf (diff)
V4L/DVB (6350): V4L: possible leak in em28xx_init_isoc
Coverity (CID 1929) spotted the following: if a transfer buffer allocation fails, the last allocated urb is leaked (it hasn't been stored in dev->urb[] yet so em28xx_uninit_isoc misses it). The patch also includes a small typo fix. Signed-off-by: Florin Malita <fmalita@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/video/em28xx/em28xx-core.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index d3282ec62c5b..d56484f20467 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -648,7 +648,7 @@ void em28xx_uninit_isoc(struct em28xx *dev)
648 */ 648 */
649int em28xx_init_isoc(struct em28xx *dev) 649int em28xx_init_isoc(struct em28xx *dev)
650{ 650{
651 /* change interface to 3 which allowes the biggest packet sizes */ 651 /* change interface to 3 which allows the biggest packet sizes */
652 int i, errCode; 652 int i, errCode;
653 const int sb_size = EM28XX_NUM_PACKETS * dev->max_pkt_size; 653 const int sb_size = EM28XX_NUM_PACKETS * dev->max_pkt_size;
654 654
@@ -673,6 +673,7 @@ int em28xx_init_isoc(struct em28xx *dev)
673 ("unable to allocate %i bytes for transfer buffer %i\n", 673 ("unable to allocate %i bytes for transfer buffer %i\n",
674 sb_size, i); 674 sb_size, i);
675 em28xx_uninit_isoc(dev); 675 em28xx_uninit_isoc(dev);
676 usb_free_urb(urb);
676 return -ENOMEM; 677 return -ENOMEM;
677 } 678 }
678 memset(dev->transfer_buffer[i], 0, sb_size); 679 memset(dev->transfer_buffer[i], 0, sb_size);