| From 0c1df555b18afc63dab6eb6f5bd255fb19d1537e Mon Sep 17 00:00:00 2001 |
| From: Kangjie Lu <kjlu@umn.edu> |
| Date: Fri, 18 Oct 2019 01:47:00 -0300 |
| Subject: [PATCH] media: rcar_drif: fix a memory disclosure |
| |
| commit d39083234c60519724c6ed59509a2129fd2aed41 upstream. |
| |
| "f->fmt.sdr.reserved" is uninitialized. As other peer drivers |
| like msi2500 and airspy do, the fix initializes it to avoid |
| memory disclosures. |
| |
| Signed-off-by: Kangjie Lu <kjlu@umn.edu> |
| Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c |
| index 608e5217ccd5..0f267a237b42 100644 |
| --- a/drivers/media/platform/rcar_drif.c |
| +++ b/drivers/media/platform/rcar_drif.c |
| @@ -912,6 +912,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, |
| { |
| struct rcar_drif_sdr *sdr = video_drvdata(file); |
| |
| + memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); |
| f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; |
| f->fmt.sdr.buffersize = sdr->fmt->buffersize; |
| |
| -- |
| 2.7.4 |
| |
