Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 550f45bc authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab
Browse files

[media] v4l: xilinx: harmless buffer overflow 



My static checker warns that the name of the port can be 15 characters
when you consider the NUL terminator and that's one more than the 14
characters in name[].  Maybe it's an off-by-one?

It's unlikely that we hit the limit and even if we do the overflow will
only affect one of the two bytes of padding so it's harmless.  Still
let's fix it and also change the sprintf() to snprintf().

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent 2235cf63

drivers/media/platform/xilinx/xilinx-dma.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -653,7 +653,7 @@ static const struct v4l2_file_operations xvip_dma_fops = { 
int xvip_dma_init(struct xvip_composite_device *xdev, struct xvip_dma *dma,

int xvip_dma_init(struct xvip_composite_device *xdev, struct xvip_dma *dma,

		  enum v4l2_buf_type type, unsigned int port)

		  enum v4l2_buf_type type, unsigned int port)

{

{

	char name[14];

	char name[16];

	int ret;

	int ret;





	dma->xdev = xdev;

	dma->xdev = xdev;
@@ -725,7 +725,7 @@ int xvip_dma_init(struct xvip_composite_device *xdev, struct xvip_dma *dma, 
	}

	}





	/* ... and the DMA channel. */

	/* ... and the DMA channel. */

	sprintf(name, "port%u", port);

	snprintf(name, sizeof(name), "port%u", port);

	dma->dma = dma_request_slave_channel(dma->xdev->dev, name);

	dma->dma = dma_request_slave_channel(dma->xdev->dev, name);

	if (dma->dma == NULL) {

	if (dma->dma == NULL) {

		dev_err(dma->xdev->dev, "no VDMA channel found\n");

		dev_err(dma->xdev->dev, "no VDMA channel found\n");