Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c18b0a3b authored by Hans Verkuil's avatar Hans Verkuil Committed by Greg Kroah-Hartman
Browse files

media: hdpvr: add terminating 0 at end of string 

[ Upstream commit 8b8900b729e4f31f12ac1127bde137c775c327e6 ]

dev->usbc_buf was passed as argument for %s, but it was not safeguarded
by a terminating 0.

This caused this syzbot issue:

https://syzkaller.appspot.com/bug?extid=79d18aac4bf1770dd050



Reported-and-tested-by: default avatar <syzbot+79d18aac4bf1770dd050@syzkaller.appspotmail.com>

Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent d44922ed

drivers/media/usb/hdpvr/hdpvr-core.c

+1 −0
Original line number Diff line number Diff line
@@ -143,6 +143,7 @@ static int device_authorization(struct hdpvr_device *dev) 


	dev->fw_ver = dev->usbc_buf[1];



	dev->usbc_buf[46] = '\0';

	v4l2_info(&dev->v4l2_dev, "firmware version 0x%x dated %s\n",

			  dev->fw_ver, &dev->usbc_buf[2]);