aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHans Verkuil <hverkuil-cisco@xs4all.nl>2022-03-21 08:33:56 +0000
committerMauro Carvalho Chehab <mchehab@kernel.org>2022-06-10 18:54:23 +0100
commit51c6aad4190b47a91f1f164fb4ab7999f886ce2c (patch)
tree514609e13abdba064eea7ac2c3e3ada088c25325
parenta39db23d1a5cfad8f047136ee5e57859d4640706 (diff)
media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args()
The v4l2_compat_get_array_args() function can leave uninitialized memory in the buffer it is passed. So zero it before copying array elements from userspace into the buffer. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reported-by: syzbot+ff18193ff05f3f87f226@syzkaller.appspotmail.com Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
-rw-r--r--drivers/media/v4l2-core/v4l2-compat-ioctl32.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 0f3d6b5667b0..55c26e7d370e 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -1040,6 +1040,8 @@ int v4l2_compat_get_array_args(struct file *file, void *mbuf,
{
int err = 0;
+ memset(mbuf, 0, array_size);
+
switch (cmd) {
case VIDIOC_G_FMT32:
case VIDIOC_S_FMT32:

Privacy Policy