diff options
| author | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-05-02 16:14:33 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-05-19 11:58:19 -0400 |
| commit | 801dd3b32d2a09a883d0cf182eb6956945e5a429 (patch) | |
| tree | ead54aa55dbf8ba99e2fbf74abdb0946663143b8 /drivers/staging | |
| parent | f4b727b3ae0cc244f803a8a0c532df06ad846a1b (diff) | |
V4L/DVB: tm6000: Don't copy outside the buffer
tm6000 tm6000_irq_callback :urb resubmit failed (error=-1)
BUG: unable to handle kernel paging request at 000000000100f700
IP: [<ffffffffa007ee79>] tm6000_irq_callback+0x51e/0xac7 [tm6000]
(gdb) list * tm6000_irq_callback+0x51e
0x2e79 is in tm6000_irq_callback (drivers/staging/tm6000/tm6000-video.c:363).
358 dev->isoc_ctl.tmp_buf_len--;
359 }
360 if (dev->isoc_ctl.tmp_buf_len) {
361 memcpy (&header,p,
362 dev->isoc_ctl.tmp_buf_l$
363 memcpy (((u8 *)header)+
364 dev->isoc_ctl.tmp_buf,
365 ptr,
366 4-dev->isoc_ctl.tmp_buf$
367 ptr+=4-dev->isoc_ctl.tmp_buf_le$
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/tm6000/tm6000-video.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/staging/tm6000/tm6000-video.c b/drivers/staging/tm6000/tm6000-video.c index edc59424d260..bed758fe4c32 100644 --- a/drivers/staging/tm6000/tm6000-video.c +++ b/drivers/staging/tm6000/tm6000-video.c | |||
| @@ -360,13 +360,13 @@ static int copy_streams(u8 *data, u8 *out_p, unsigned long len, | |||
| 360 | dev->isoc_ctl.tmp_buf_len--; | 360 | dev->isoc_ctl.tmp_buf_len--; |
| 361 | } | 361 | } |
| 362 | if (dev->isoc_ctl.tmp_buf_len) { | 362 | if (dev->isoc_ctl.tmp_buf_len) { |
| 363 | memcpy (&header,p, | 363 | memcpy(&header, p, |
| 364 | dev->isoc_ctl.tmp_buf_len); | 364 | dev->isoc_ctl.tmp_buf_len); |
| 365 | memcpy (((u8 *)header)+ | 365 | memcpy((u8 *)&header + |
| 366 | dev->isoc_ctl.tmp_buf, | 366 | dev->isoc_ctl.tmp_buf_len, |
| 367 | ptr, | 367 | ptr, |
| 368 | 4-dev->isoc_ctl.tmp_buf_len); | 368 | 4 - dev->isoc_ctl.tmp_buf_len); |
| 369 | ptr+=4-dev->isoc_ctl.tmp_buf_len; | 369 | ptr += 4 - dev->isoc_ctl.tmp_buf_len; |
| 370 | goto HEADER; | 370 | goto HEADER; |
| 371 | } | 371 | } |
| 372 | } | 372 | } |