diff options
| author | Marton Nemeth <nm127@freemail.hu> | 2009-11-05 11:40:46 +0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2009-12-05 23:41:21 +0300 |
| commit | 8337fc3053f4189fb64d60495ed89df5befa2a6b (patch) | |
| tree | 7f44096c8dc8e76ecef5aa7e3ea34d1db3816660 /drivers/media | |
| parent | 4f7309e27865b88df7b0b0ad59e0376dba1806af (diff) | |
| download | linux-8337fc3053f4189fb64d60495ed89df5befa2a6b.tar.xz | |
V4L/DVB (13325): gspca - pac7302/pac7311: Fix buffer overrun.
The reg_w_seq() function expects the sequence length in entries
and not in bytes. One entry in init_7302 and init_7311 is two
bytes and not one.
Signed-off-by: Marton Nemeth <nm127@freemail.hu>
Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/video/gspca/pac7302.c | 2 | ||||
| -rw-r--r-- | drivers/media/video/gspca/pac7311.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/video/gspca/pac7302.c b/drivers/media/video/gspca/pac7302.c index 60d1a31f5307..09d3d191d949 100644 --- a/drivers/media/video/gspca/pac7302.c +++ b/drivers/media/video/gspca/pac7302.c @@ -571,7 +571,7 @@ static void sethvflip(struct gspca_dev *gspca_dev) /* this function is called at probe and resume time for pac7302 */ static int sd_init(struct gspca_dev *gspca_dev) { - reg_w_seq(gspca_dev, init_7302, sizeof init_7302); + reg_w_seq(gspca_dev, init_7302, sizeof(init_7302)/2); return 0; } diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c index 82cdd43aada9..b1127d948974 100644 --- a/drivers/media/video/gspca/pac7311.c +++ b/drivers/media/video/gspca/pac7311.c @@ -469,7 +469,7 @@ static void sethvflip(struct gspca_dev *gspca_dev) /* this function is called at probe and resume time for pac7311 */ static int sd_init(struct gspca_dev *gspca_dev) { - reg_w_seq(gspca_dev, init_7311, sizeof init_7311); + reg_w_seq(gspca_dev, init_7311, sizeof(init_7311)/2); return 0; } |