Skip to content
Commit f7d51372 authored by Dave Stevenson's avatar Dave Stevenson Committed by Greg Kroah-Hartman
Browse files

bcm2835-v4l2: Fix buffer overflow problem

https://github.com/raspberrypi/linux/issues/1447


port_parameter_get() failed to account for the header
(u32 id and u32 size) in the size before memcpying
the response into the response buffer, so overrunning
the provided buffer by 8 bytes.

Account for those bytes, and also a belt-and-braces
check to ensure we never copy more than *value_size
bytes into value.

Signed-off-by: default avatarDave Stevenson <dave.stevenson@raspberrypi.org>
Signed-off-by: default avatarMichael Zoran <mzoran@crowfest.net>
Tested-by: default avatarMichael Zoran <mzoran@crowfest.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ce95e3a9
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment