From patchwork Wed Nov 4 22:38:42 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?TsOpbWV0aCBNw6FydG9u?= X-Patchwork-Id: 1973 Return-path: Envelope-to: mchehab@infradead.org Delivery-date: Wed, 04 Nov 2009 22:38:50 +0000 Received: from bombadil.infradead.org [18.85.46.34] by pedra.chehab.org with IMAP (fetchmail-6.3.6) for (single-drop); Wed, 04 Nov 2009 20:41:42 -0200 (BRST) Received: from vger.kernel.org ([209.132.176.167]) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1N5oV8-0008CC-7p; Wed, 04 Nov 2009 22:38:50 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932784AbZKDWin (ORCPT + 1 other); Wed, 4 Nov 2009 17:38:43 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S932782AbZKDWin (ORCPT ); Wed, 4 Nov 2009 17:38:43 -0500 Received: from mail02a.mail.t-online.hu ([84.2.40.7]:54806 "EHLO mail02a.mail.t-online.hu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932730AbZKDWim (ORCPT ); Wed, 4 Nov 2009 17:38:42 -0500 Received: from [192.168.1.64] (dsl5402C4D0.pool.t-online.hu [84.2.196.208]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail02a.mail.t-online.hu (Postfix) with ESMTPSA id 64037256C89; Wed, 4 Nov 2009 23:38:32 +0100 (CET) Message-ID: <4AF20272.7040104@freemail.hu> Date: Wed, 04 Nov 2009 23:38:42 +0100 From: =?ISO-8859-2?Q?N=E9meth_M=E1rton?= User-Agent: Mozilla/5.0 (X11; U; Linux i686; hu-HU; rv:1.8.1.21) Gecko/20090402 SeaMonkey/1.1.16 MIME-Version: 1.0 To: Jean-Francois Moine , V4L Mailing List Subject: [PATCH] gspca pac7302/pac7311: fix buffer overrun X-DCC-mail.t-online.hu-Metrics: mail02a.mail.t-online.hu 32721; Body=2 Fuz1=2 Fuz2=2 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Márton Németh The reg_w_seq() function expects the sequence length in entries and not in bytes. One entry in init_7302 and init_7311 is two bytes and not one. Signed-off-by: Márton Németh --- -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff -upr a/drivers/media/video/gspca/pac7302.c b/drivers/media/video/gspca/pac7302.c --- a/drivers/media/video/gspca/pac7302.c 2009-11-05 00:31:36.000000000 +0100 +++ b/drivers/media/video/gspca/pac7302.c 2009-11-05 00:32:50.000000000 +0100 @@ -592,7 +592,7 @@ static void sethvflip(struct gspca_dev * /* this function is called at probe and resume time for pac7302 */ static int sd_init(struct gspca_dev *gspca_dev) { - reg_w_seq(gspca_dev, init_7302, sizeof init_7302); + reg_w_seq(gspca_dev, init_7302, sizeof(init_7302)/2); return 0; } diff -upr a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c --- a/drivers/media/video/gspca/pac7311.c 2009-11-04 23:28:31.000000000 +0100 +++ b/drivers/media/video/gspca/pac7311.c 2009-11-05 00:33:08.000000000 +0100 @@ -490,7 +490,7 @@ static void sethvflip(struct gspca_dev * /* this function is called at probe and resume time for pac7311 */ static int sd_init(struct gspca_dev *gspca_dev) { - reg_w_seq(gspca_dev, init_7311, sizeof init_7311); + reg_w_seq(gspca_dev, init_7311, sizeof(init_7311)/2); return 0; }