A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 21:59:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

media: winbond-cir: buffer overrun during transmit

Browse source 
We're reading beyond the buffer before checking its length.

BUG: KASAN: slab-out-of-bounds in wbcir_irq_tx

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Sean Young 2017-08-04 06:33:41 -04:00 • committed by Mauro Carvalho Chehab
commit 4fe055ecfc
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/media/rc/winbond-cir.c
View file

@ -429,7 +429,7 @@ wbcir_irq_tx(struct wbcir_data *data)
bytes[used] = byte;
}
while (data->txbuf[data->txoff] == 0 && data->txoff != data->txlen)
while (data->txoff != data->txlen && data->txbuf[data->txoff] == 0)
data->txoff++;
if (used == 0) {