diff options
| author | Gustavo A. R. Silva <gustavoars@kernel.org> | 2022-01-21 00:24:34 +0300 |
|---|---|---|
| committer | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2022-02-22 11:41:11 +0300 |
| commit | dca4f5fdbcd7dddcd2169be2c3bf3057d51b100e (patch) | |
| tree | 391fccefb014ce76a1313df17585a3ee193d63bd /drivers/media/usb | |
| parent | 4f03d537ce08f93d8dc3dd1273a32f2551599000 (diff) | |
| download | linux-dca4f5fdbcd7dddcd2169be2c3bf3057d51b100e.tar.xz | |
media: usb: pwc-uncompress: Use struct_size() helper in pwc_decompress()
Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows that,
in the worst scenario, could lead to heap overflows.
Also, address the following sparse warnings:
drivers/media/usb/pwc/pwc-uncompress.c:44:44: warning: using sizeof on a flexible structure
Link: https://github.com/KSPP/linux/issues/174
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Diffstat (limited to 'drivers/media/usb')
| -rw-r--r-- | drivers/media/usb/pwc/pwc-uncompress.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/usb/pwc/pwc-uncompress.c b/drivers/media/usb/pwc/pwc-uncompress.c index 68bc3829c6b3..faf44cdeb268 100644 --- a/drivers/media/usb/pwc/pwc-uncompress.c +++ b/drivers/media/usb/pwc/pwc-uncompress.c @@ -41,7 +41,7 @@ int pwc_decompress(struct pwc_device *pdev, struct pwc_frame_buf *fbuf) memcpy(raw_frame->cmd, pdev->cmd_buf, 4); memcpy(raw_frame+1, yuv, pdev->frame_size); vb2_set_plane_payload(&fbuf->vb.vb2_buf, 0, - pdev->frame_size + sizeof(struct pwc_raw_frame)); + struct_size(raw_frame, rawframe, pdev->frame_size)); return 0; } |