Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 749d00db authored Aug 07, 2009 by Roel Kluin Committed by Greg Kroah-Hartman Aug 07, 2009

Staging: rspiusb: Fix buffer overflow



usb_buffer_map_sg() may return -1. This will result in a read from
pdx->PixelUrb[frameInfo][-1]

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

parent 5fb4d252

drivers/staging/rspiusb/rspiusb.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -716,6 +716,8 @@ static int MapUserBuffer(struct ioctl_struct io, struct device_extension pdx)
		pdx->PixelUrb[frameInfo][i]->transfer_flags =
		URB_NO_TRANSFER_DMA_MAP \| URB_NO_INTERRUPT;
		}
		if (i == 0)
		return -EINVAL;
		/* only interrupt when last URB completes */
		pdx->PixelUrb[frameInfo][--i]->transfer_flags &= ~URB_NO_INTERRUPT;
		pdx->pendedPixelUrbs[frameInfo] =