提交 586c61fd 编写于 作者: S Sean Young 提交者: Mauro Carvalho Chehab

[media] rc: fix buffer overrun

"[media] rc-core: move timeout and checks to lirc" introduced a buffer
overrun by passing the number of bytes, rather than the number of samples,
to the transmit function.
Signed-off-by: NSean Young <sean@mess.org>
Acked-by: NDavid Härdeman <david@hardeman.nu>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
上级 b0c47e1e
......@@ -140,7 +140,7 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf,
goto out;
}
ret = dev->tx_ir(dev, txbuf, (u32)n);
ret = dev->tx_ir(dev, txbuf, count);
if (ret < 0)
goto out;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册