From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 14 Mar 2013 08:01:05 +0000 (+0300)
Subject: usb: gadget: uvc: use capped length value
X-Git-Tag: upstream/snapshot3+hdmi~5288^2~11^2~100
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git

usb: gadget: uvc: use capped length value

"req->length" is a capped version of "data->length".

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
---

diff --git a/drivers/usb/gadget/uvc_v4l2.c b/drivers/usb/gadget/uvc_v4l2.c
index a6c728a..bb140dd 100644
--- a/drivers/usb/gadget/uvc_v4l2.c
+++ b/drivers/usb/gadget/uvc_v4l2.c
@@ -42,7 +42,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data)
 	req->length = min_t(unsigned int, uvc->event_length, data->length);
 	req->zero = data->length < uvc->event_length;
 
-	memcpy(req->buf, data->data, data->length);
+	memcpy(req->buf, data->data, req->length);
 
 	return usb_ep_queue(cdev->gadget->ep0, req, GFP_KERNEL);
 }