mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-30 14:19:16 +00:00
Code Issues Releases Wiki Activity

[media] pms: Fix a bad usage of the stack

Browse source 
As warned by smatch:
	drivers/media/parport/pms.c:632:21: warning: Variable length array is used.

The pms driver is doing something really bad: it is using the
stack to read data into a buffer whose size is given by the
user by the read() syscall. Replace it by a dynamically allocated
buffer.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This commit is contained in:
Mauro Carvalho Chehab 2014-09-24 15:35:55 -03:00
parent 5a9ff85dc1
commit 64e01cbd9d
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
drivers/media/parport/pms.c
View file

@ -629,11 +629,15 @@ static int pms_capture(struct pms *dev, char __user *buf, int rgb555, int count)
{
int y;
int dw = 2 * dev->width;
char tmp[dw + 32]; /* using a temp buffer is faster than direct */
char *tmp; /* using a temp buffer is faster than direct */
int cnt = 0;
int len = 0;
unsigned char r8 = 0x5; /* value for reg8 */
tmp = kmalloc(dw + 32, GFP_KERNEL);
if (!tmp)
return 0;
if (rgb555)
r8 |= 0x20; /* else use untranslated rgb = 565 */
mvv_write(dev, 0x08, r8); /* capture rgb555/565, init DRAM, PC enable */
@ -664,6 +668,7 @@ static int pms_capture(struct pms *dev, char __user *buf, int rgb555, int count)
len += dt;
}
}
kfree(tmp);
return len;
}