Skip to content

Commit

Permalink
[media] cec: fix off-by-one memset
Browse files Browse the repository at this point in the history
The unused bytes of the features array should be zeroed, but the start index was one
byte too early. This caused the device features byte to be overwritten by 0.

The compliance test for the CEC_S_LOG_ADDRS ioctl didn't catch this because it tested
byte continuation with the second device features byte being 0 :-(

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
  • Loading branch information
hverkuil authored and mchehab committed Jul 28, 2016
1 parent cd70c37 commit 292eaf5
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/staging/media/cec/cec-adap.c
Original file line number Diff line number Diff line change
Expand Up @@ -1252,7 +1252,7 @@ int __cec_s_log_addrs(struct cec_adapter *adap,
return -EINVAL;
}
/* Zero unused part of the feature array */
memset(features + i, 0, feature_sz - i);
memset(features + i + 1, 0, feature_sz - i - 1);
}

if (log_addrs->cec_version >= CEC_OP_CEC_VERSION_2_0) {
Expand Down

0 comments on commit 292eaf5

Please sign in to comment.