Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba3f404a authored by Ayaz Ahmad's avatar Ayaz Ahmad
Browse files

radio: iris: Prevent probable overflow 



casting a unsigned int into an integer, integer to
unsigned int may cause buffer overflow.

Change-Id: I54be4d4c5470616a59a772c587fe6d5f32575c32
CRs-Fixed: 539008
Signed-off-by: default avatarAyaz Ahmad <aahmad@codeaurora.org>
parent 1acf35fb

drivers/media/radio/radio-iris.c

+10 −4
Original line number Diff line number Diff line
@@ -3032,7 +3032,7 @@ static int iris_vidioc_s_ext_ctrls(struct file *file, void *priv, 
			struct v4l2_ext_controls *ctrl)

{

	int retval = 0;

	int bytes_to_copy;

	size_t bytes_to_copy;

	struct hci_fm_tx_ps tx_ps;

	struct hci_fm_tx_rt tx_rt;

	struct hci_fm_def_data_wr_req default_data;
@@ -3041,13 +3041,19 @@ static int iris_vidioc_s_ext_ctrls(struct file *file, void *priv, 
	struct iris_device *radio = video_get_drvdata(video_devdata(file));

	char *data = NULL;



	if ((ctrl == NULL) || (ctrl->controls == NULL)

		|| (ctrl->count == 0)) {

		retval = -EINVAL;

		return retval;

	}



	switch ((ctrl->controls[0]).id) {

	case V4L2_CID_RDS_TX_PS_NAME:

		FMDBG("In V4L2_CID_RDS_TX_PS_NAME\n");

		/*Pass a sample PS string */



		memset(tx_ps.ps_data, 0, MAX_PS_LENGTH);

		bytes_to_copy = min((int)(ctrl->controls[0]).size,

		bytes_to_copy = min_t(size_t, ctrl->controls[0].size,

					MAX_PS_LENGTH);

		data = (ctrl->controls[0]).string;
@@ -3065,7 +3071,7 @@ static int iris_vidioc_s_ext_ctrls(struct file *file, void *priv, 
		break;

	case V4L2_CID_RDS_TX_RADIO_TEXT:

		bytes_to_copy =

		    min((int)(ctrl->controls[0]).size, MAX_RT_LENGTH);

		    min_t(size_t, (ctrl->controls[0]).size, MAX_RT_LENGTH);

		data = (ctrl->controls[0]).string;



		memset(tx_rt.rt_data, 0, MAX_RT_LENGTH);