diff options
| author | Frank Chen <frankc@nvidia.com> | 2012-08-01 16:17:44 -0700 |
|---|---|---|
| committer | Simone Willett <swillett@nvidia.com> | 2012-08-06 17:46:50 -0700 |
| commit | db493730cc14102d6d9755de91d50913203e4982 (patch) | |
| tree | 11816445fb6a54c243863839b6e00f7b3c721282 /drivers | |
| parent | 6725d72413a003cddd13ccbb1611a9573c7f963e (diff) | |
media: video: tegra: fix sh532u buffer overflows
We need to validate the buffer size before we
copy buffers from/to user space.
Bug 1027334
Change-Id: I0717e9ff1d2e5eb3e8a863555457f4bcfdbb2cb9
Signed-off-by: Frank Chen <frankc@nvidia.com>
Reviewed-on: http://git-master/r/120185
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Charlie Huang <chahuang@nvidia.com>
Reviewed-by: Patrick Shehane <pshehane@nvidia.com>
Reviewed-by: Dan Willemsen <dwillemsen@nvidia.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/video/tegra/sh532u.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/media/video/tegra/sh532u.c b/drivers/media/video/tegra/sh532u.c index 84692d992154..e41dd1f4afb1 100644 --- a/drivers/media/video/tegra/sh532u.c +++ b/drivers/media/video/tegra/sh532u.c @@ -1406,9 +1406,9 @@ static int sh532u_set_focuser_capabilities(struct sh532u_info *info, struct nvc_param *params) { if (copy_from_user(&info->config, (const void __user *)params->p_value, - params->sizeofvalue)) { + sizeof(struct nv_focuser_config))) { dev_err(&info->i2c_client->dev, "%s Error: copy_from_user bytes %d\n", - __func__, params->sizeofvalue); + __func__, sizeof(struct nv_focuser_config)); return -EFAULT; } @@ -1420,7 +1420,7 @@ static int sh532u_set_focuser_capabilities(struct sh532u_info *info, info->config.slew_rate = info->config.slew_rate; dev_dbg(&info->i2c_client->dev, "%s: copy_from_user bytes %d\n", - __func__, params->sizeofvalue); + __func__, sizeof(struct nv_focuser_config)); return 0; } @@ -1491,7 +1491,7 @@ static int sh532u_param_rd(struct sh532u_info *info, unsigned long arg) sh532u_get_focuser_capabilities(info); data_ptr = &info->config; - data_size = params.sizeofvalue; + data_size = sizeof(info->config); break; case NVC_PARAM_STS: |