diff options
| author | Sean Young | 2017-08-04 12:33:41 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab | 2017-08-20 15:52:04 +0200 |
| commit | 4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3 (patch) | |
| tree | c65bb10255e99db2865e74a188ee9e94356efdee /drivers/media/rc/winbond-cir.c | |
| parent | media: mceusb: do not read data parameters unless required (diff) | |
| download | kernel-qcow2-linux-4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3.tar.gz kernel-qcow2-linux-4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3.tar.xz kernel-qcow2-linux-4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3.zip | |
media: winbond-cir: buffer overrun during transmit
We're reading beyond the buffer before checking its length.
BUG: KASAN: slab-out-of-bounds in wbcir_irq_tx
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/rc/winbond-cir.c')
| -rw-r--r-- | drivers/media/rc/winbond-cir.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c index ea7be6d35ff8..a18eb232ed81 100644 --- a/drivers/media/rc/winbond-cir.c +++ b/drivers/media/rc/winbond-cir.c @@ -429,7 +429,7 @@ wbcir_irq_tx(struct wbcir_data *data) bytes[used] = byte; } - while (data->txbuf[data->txoff] == 0 && data->txoff != data->txlen) + while (data->txoff != data->txlen && data->txbuf[data->txoff] == 0) data->txoff++; if (used == 0) { |