提交 6ac725c4 编写于 作者: K Kangjie Lu 提交者: Xie XiuQi

media: rcar_drif: fix a memory disclosure

hulk inclusion
category: bugfix
bugzilla: 13690
CVE: CVE-2019-18786

-------------------------------------------------

"f->fmt.sdr.reserved" is uninitialized. As other peer drivers
like msi2500 and airspy do, the fix initializes it to avoid
memory disclosures.
Signed-off-by: NKangjie Lu <kjlu@umn.edu>
Reviewed-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: NWenan Mao <maowenan@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
上级 7a801744
...@@ -912,6 +912,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, ...@@ -912,6 +912,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv,
{ {
struct rcar_drif_sdr *sdr = video_drvdata(file); struct rcar_drif_sdr *sdr = video_drvdata(file);
memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved));
f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; f->fmt.sdr.pixelformat = sdr->fmt->pixelformat;
f->fmt.sdr.buffersize = sdr->fmt->buffersize; f->fmt.sdr.buffersize = sdr->fmt->buffersize;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册