Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4fe055ec authored by Sean Young's avatar Sean Young Committed by Mauro Carvalho Chehab
Browse files

media: winbond-cir: buffer overrun during transmit 



We're reading beyond the buffer before checking its length.

BUG: KASAN: slab-out-of-bounds in wbcir_irq_tx

Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent ff05cf09

drivers/media/rc/winbond-cir.c

+1 −1
Original line number Diff line number Diff line
@@ -429,7 +429,7 @@ wbcir_irq_tx(struct wbcir_data *data) 
		bytes[used] = byte;

	}



	while (data->txbuf[data->txoff] == 0 && data->txoff != data->txlen)

	while (data->txoff != data->txlen && data->txbuf[data->txoff] == 0)

		data->txoff++;



	if (used == 0) {