V4L/DVB: tm6000: Don't copy outside the buffer
authorMauro Carvalho Chehab <mchehab@redhat.com>
Sun, 2 May 2010 20:14:33 +0000 (17:14 -0300)
committerMauro Carvalho Chehab <mchehab@redhat.com>
Wed, 19 May 2010 15:58:19 +0000 (12:58 -0300)
commit801dd3b32d2a09a883d0cf182eb6956945e5a429
treeead54aa55dbf8ba99e2fbf74abdb0946663143b8
parentf4b727b3ae0cc244f803a8a0c532df06ad846a1b
V4L/DVB: tm6000: Don't copy outside the buffer

tm6000 tm6000_irq_callback :urb resubmit failed (error=-1)
BUG: unable to handle kernel paging request at 000000000100f700
IP: [<ffffffffa007ee79>] tm6000_irq_callback+0x51e/0xac7 [tm6000]

(gdb) list * tm6000_irq_callback+0x51e
0x2e79 is in tm6000_irq_callback (drivers/staging/tm6000/tm6000-video.c:363).
358                                             dev->isoc_ctl.tmp_buf_len--;
359                                     }
360                                     if (dev->isoc_ctl.tmp_buf_len) {
361                                             memcpy (&header,p,
362                                                     dev->isoc_ctl.tmp_buf_l$
363                                             memcpy (((u8 *)header)+
364                                                     dev->isoc_ctl.tmp_buf,
365                                                     ptr,
366                                                     4-dev->isoc_ctl.tmp_buf$
367                                             ptr+=4-dev->isoc_ctl.tmp_buf_le$

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/staging/tm6000/tm6000-video.c