[media] pms: Fix a bad usage of the stack (64e01cbd) · Commits · 戴 / test

As warned by smatch: drivers/media/parport/pms.c:632:21: warning: Variable length array is used. The pms driver is doing something really bad: it is using the stack to read data into a buffer whose size is given by the user by the read() syscall. Replace it by a dynamically allocated buffer. Signed-off-by:

Mauro Carvalho Chehab <mchehab@osg.samsung.com>

drivers/media/parport/pms.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -629,11 +629,15 @@ static int pms_capture(struct pms dev, char __user buf, int rgb555, int count)
		{
		int y;
		int dw = 2 * dev->width;
		char tmp[dw + 32]; /* using a temp buffer is faster than direct */
		char tmp; / using a temp buffer is faster than direct */
		int cnt = 0;
		int len = 0;
		unsigned char r8 = 0x5; /* value for reg8 */

		tmp = kmalloc(dw + 32, GFP_KERNEL);
		if (!tmp)
		return 0;

		if (rgb555)
		r8 \|= 0x20; /* else use untranslated rgb = 565 */
		mvv_write(dev, 0x08, r8); /* capture rgb555/565, init DRAM, PC enable */
		@@ -664,6 +668,7 @@ static int pms_capture(struct pms dev, char __user buf, int rgb555, int count)
		len += dt;
		}
		}
		kfree(tmp);
		return len;
		}

Admin message