V4L/DVB (7235): tuner-simple: fix a buffer overflow
authorMauro Carvalho Chehab <mchehab@infradead.org>
Tue, 22 Apr 2008 17:42:13 +0000 (14:42 -0300)
committerMauro Carvalho Chehab <mchehab@infradead.org>
Thu, 24 Apr 2008 17:07:44 +0000 (14:07 -0300)
commitf13613acfb1a71895ac886dc831d6ae4e20e241a
treeead5941f87548b9848837dab2d78d364913037de
parent6a6179b6db401acde5798b4da0fdff32b126ee15
V4L/DVB (7235): tuner-simple: fix a buffer overflow

simple_set_tv() creates a buffer with 4 elements, and calls
simple_std_setup(), passing &buffer[1]. This makes the 5th element of buffer to
be initialized to 0, overriding some area outside the buffer.

Also, simple_std_setup() receives a buffer as parameter, but the buffer is
just overriden after the call, so, it doesn't make much sense to pass it as a
parameter.

This patch removes buffer[] from the function call, creating, instead, a local
var to be used internally.

Thanks to Axel Rometsch <axel.rometsch@freenet.de> for pointing the issue.

Reviewed-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
drivers/media/video/tuner-simple.c