Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f4d7239 authored by Alan Cox's avatar Alan Cox Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (11959): se401: Fix unsafe use of sprintf with identical source/destination 

Closes-bug: http://bugzilla.kernel.org/show_bug.cgi?id=13435



Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Signed-off-by: default avatarDouglas Schilling Landgraf <dougsland@redhat.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 5e2c217e

drivers/media/video/se401.c

+6 −4
Original line number Original line Diff line number Diff line
@@ -1244,6 +1244,7 @@ static int se401_init(struct usb_se401 *se401, int button) 
	int i=0, rc;

	int i=0, rc;

	unsigned char cp[0x40];

	unsigned char cp[0x40];

	char temp[200];

	char temp[200];

	int slen;





	/* led on */

	/* led on */

	se401_sndctrl(1, se401, SE401_REQ_LED_CONTROL, 1, NULL, 0);

	se401_sndctrl(1, se401, SE401_REQ_LED_CONTROL, 1, NULL, 0);
@@ -1254,7 +1255,7 @@ static int se401_init(struct usb_se401 *se401, int button) 
		err("Wrong descriptor type");

		err("Wrong descriptor type");

		return 1;

		return 1;

	}

	}

	sprintf (temp, "ExtraFeatures: %d", cp[3]);

	slen = snprintf(temp, 200, "ExtraFeatures: %d", cp[3]);





	se401->sizes=cp[4]+cp[5]*256;

	se401->sizes=cp[4]+cp[5]*256;

	se401->width=kmalloc(se401->sizes*sizeof(int), GFP_KERNEL);

	se401->width=kmalloc(se401->sizes*sizeof(int), GFP_KERNEL);
@@ -1269,9 +1270,10 @@ static int se401_init(struct usb_se401 *se401, int button) 
		    se401->width[i]=cp[6+i*4+0]+cp[6+i*4+1]*256;

		    se401->width[i]=cp[6+i*4+0]+cp[6+i*4+1]*256;

		    se401->height[i]=cp[6+i*4+2]+cp[6+i*4+3]*256;

		    se401->height[i]=cp[6+i*4+2]+cp[6+i*4+3]*256;

	}

	}

	sprintf (temp, "%s Sizes:", temp);

	slen += snprintf (temp + slen, 200 - slen, " Sizes:");

	for (i=0; i<se401->sizes; i++) {

	for (i=0; i<se401->sizes; i++) {

		sprintf(temp, "%s %dx%d", temp, se401->width[i], se401->height[i]);

		slen += snprintf(temp + slen, 200 - slen,

			" %dx%d", se401->width[i], se401->height[i]);

	}

	}

	dev_info(&se401->dev->dev, "%s\n", temp);

	dev_info(&se401->dev->dev, "%s\n", temp);

	se401->maxframesize=se401->width[se401->sizes-1]*se401->height[se401->sizes-1]*3;

	se401->maxframesize=se401->width[se401->sizes-1]*se401->height[se401->sizes-1]*3;