• Mauro Carvalho Chehab's avatar
    V4L/DVB (7235): tuner-simple: fix a buffer overflow · f13613ac
    Mauro Carvalho Chehab authored
    simple_set_tv() creates a buffer with 4 elements, and calls
    simple_std_setup(), passing &buffer[1]. This makes the 5th element of buffer to
    be initialized to 0, overriding some area outside the buffer.
    
    Also, simple_std_setup() receives a buffer as parameter, but the buffer is
    just overriden after the call, so, it doesn't make much sense to pass it as a
    parameter.
    
    This patch removes buffer[] from the function call, creating, instead, a local
    var to be used internally.
    
    Thanks to Axel Rometsch <axel.rometsch@freenet.de> for pointing the issue.
    Reviewed-by: default avatarMichael Krufky <mkrufky@linuxtv.org>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@infradead.org>
    f13613ac
tuner-simple.c 19.6 KB