lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

V4L/DVB (11959): se401: Fix unsafe use of sprintf with identical source/destination

Browse Source 
Closes-bug: http://bugzilla.kernel.org/show_bug.cgi?id=13435

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Douglas Schilling Landgraf <dougsland@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Alan Cox
2009-06-11 11:04:11 -03:00
committed by Mauro Carvalho Chehab
parent 5e2c217eee
commit 6f4d72392d
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/media/video/se401.c
View File

@@ -1244,17 +1244,18 @@ static int se401_init(struct usb_se401 *se401, int button)
int i=0, rc; int i=0, rc;
unsigned char cp[0x40]; unsigned char cp[0x40];
char temp[200]; char temp[200];
int slen;
/* led on */ /* led on */
se401_sndctrl(1, se401, SE401_REQ_LED_CONTROL, 1, NULL, 0); se401_sndctrl(1, se401, SE401_REQ_LED_CONTROL, 1, NULL, 0);
/* get camera descriptor */ /* get camera descriptor */
rc=se401_sndctrl(0, se401, SE401_REQ_GET_CAMERA_DESCRIPTOR, 0, cp, sizeof(cp)); rc=se401_sndctrl(0, se401, SE401_REQ_GET_CAMERA_DESCRIPTOR, 0, cp, sizeof(cp));
if (cp[1]!=0x41) { if (cp[1] != 0x41) {
err("Wrong descriptor type"); err("Wrong descriptor type");
return 1; return 1;
} }
sprintf (temp, "ExtraFeatures: %d", cp[3]); slen = snprintf(temp, 200, "ExtraFeatures: %d", cp[3]);
se401->sizes=cp[4]+cp[5]*256; se401->sizes=cp[4]+cp[5]*256;
se401->width=kmalloc(se401->sizes*sizeof(int), GFP_KERNEL); se401->width=kmalloc(se401->sizes*sizeof(int), GFP_KERNEL);
@@ -1269,9 +1270,10 @@ static int se401_init(struct usb_se401 *se401, int button)
se401->width[i]=cp[6+i*4+0]+cp[6+i*4+1]*256; se401->width[i]=cp[6+i*4+0]+cp[6+i*4+1]*256;
se401->height[i]=cp[6+i*4+2]+cp[6+i*4+3]*256; se401->height[i]=cp[6+i*4+2]+cp[6+i*4+3]*256;
} }
sprintf (temp, "%s Sizes:", temp); slen += snprintf (temp + slen, 200 - slen, " Sizes:");
for (i=0; i<se401->sizes; i++) { for (i=0; i<se401->sizes; i++) {
sprintf(temp, "%s %dx%d", temp, se401->width[i], se401->height[i]); slen += snprintf(temp + slen, 200 - slen,
" %dx%d", se401->width[i], se401->height[i]);
} }
dev_info(&se401->dev->dev, "%s\n", temp); dev_info(&se401->dev->dev, "%s\n", temp);
se401->maxframesize=se401->width[se401->sizes-1]*se401->height[se401->sizes-1]*3; se401->maxframesize=se401->width[se401->sizes-1]*se401->height[se401->sizes-1]*3;