Commit 8b8900b7 authored Aug 15, 2019 by Hans Verkuil Committed by Mauro Carvalho Chehab Aug 19, 2019

media: hdpvr: add terminating 0 at end of string

dev->usbc_buf was passed as argument for %s, but it was not safeguarded
by a terminating 0.

This caused this syzbot issue:

https://syzkaller.appspot.com/bug?extid=79d18aac4bf1770dd050



Reported-and-tested-by:  <syzbot+79d18aac4bf1770dd050@syzkaller.appspotmail.com>

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

parent 0d616f2a

drivers/media/usb/hdpvr/hdpvr-core.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -137,6 +137,7 @@ static int device_authorization(struct hdpvr_device *dev)

		dev->fw_ver = dev->usbc_buf[1];

		dev->usbc_buf[46] = '\0';
		v4l2_info(&dev->v4l2_dev, "firmware version 0x%x dated %s\n",
		dev->fw_ver, &dev->usbc_buf[2]);

Admin message