| From 1c73d0b29d04bf4082e7beb6a508895e118ee30d Mon Sep 17 00:00:00 2001 |
| From: Mauro Carvalho Chehab <mchehab@kernel.org> |
| Date: Mon, 29 Apr 2024 15:15:05 +0100 |
| Subject: media: dw2102: fix a potential buffer overflow |
| |
| From: Mauro Carvalho Chehab <mchehab@kernel.org> |
| |
| commit 1c73d0b29d04bf4082e7beb6a508895e118ee30d upstream. |
| |
| As pointed by smatch: |
| drivers/media/usb/dvb-usb/dw2102.c:802 su3000_i2c_transfer() error: __builtin_memcpy() '&state->data[4]' too small (64 vs 67) |
| |
| That seemss to be due to a wrong copy-and-paste. |
| |
| Fixes: 0e148a522b84 ("media: dw2102: Don't translate i2c read into write") |
| |
| Reported-by: Hans Verkuil <hverkuil@xs4all.nl> |
| Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/media/usb/dvb-usb/dw2102.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/media/usb/dvb-usb/dw2102.c |
| +++ b/drivers/media/usb/dvb-usb/dw2102.c |
| @@ -786,7 +786,7 @@ static int su3000_i2c_transfer(struct i2 |
| |
| if (msg[j].flags & I2C_M_RD) { |
| /* single read */ |
| - if (1 + msg[j].len > sizeof(state->data)) { |
| + if (4 + msg[j].len > sizeof(state->data)) { |
| warn("i2c rd: len=%d is too big!\n", msg[j].len); |
| num = -EOPNOTSUPP; |
| break; |
