From dca4f5fdbcd7dddcd2169be2c3bf3057d51b100e Mon Sep 17 00:00:00 2001 From: "Gustavo A. R. Silva" Date: Thu, 20 Jan 2022 15:24:34 -0600 Subject: [PATCH] media: usb: pwc-uncompress: Use struct_size() helper in pwc_decompress() Make use of the struct_size() helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worst scenario, could lead to heap overflows. Also, address the following sparse warnings: drivers/media/usb/pwc/pwc-uncompress.c:44:44: warning: using sizeof on a flexible structure Link: https://github.com/KSPP/linux/issues/174 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Hans Verkuil --- drivers/media/usb/pwc/pwc-uncompress.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/pwc/pwc-uncompress.c b/drivers/media/usb/pwc/pwc-uncompress.c index 68bc382..faf44cd 100644 --- a/drivers/media/usb/pwc/pwc-uncompress.c +++ b/drivers/media/usb/pwc/pwc-uncompress.c @@ -41,7 +41,7 @@ int pwc_decompress(struct pwc_device *pdev, struct pwc_frame_buf *fbuf) memcpy(raw_frame->cmd, pdev->cmd_buf, 4); memcpy(raw_frame+1, yuv, pdev->frame_size); vb2_set_plane_payload(&fbuf->vb.vb2_buf, 0, - pdev->frame_size + sizeof(struct pwc_raw_frame)); + struct_size(raw_frame, rawframe, pdev->frame_size)); return 0; } -- 2.7.4