| Message ID | 1345756705-17576-1-git-send-email-sean@mess.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, Aug 23, 2012 at 10:18:25PM +0100, Sean Young wrote: >"[media] rc-core: move timeout and checks to lirc" introduced a buffer >overrun by passing the number of bytes, rather than the number of samples, >to the transmit function. > >Signed-off-by: Sean Young <sean@mess.org> Acked-by: David Härdeman <david@hardeman.nu> Thanks for noticing >--- > drivers/media/rc/ir-lirc-codec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c >index 6ad4a07..569124b 100644 >--- a/drivers/media/rc/ir-lirc-codec.c >+++ b/drivers/media/rc/ir-lirc-codec.c >@@ -140,7 +140,7 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf, > goto out; > } > >- ret = dev->tx_ir(dev, txbuf, (u32)n); >+ ret = dev->tx_ir(dev, txbuf, count); > if (ret < 0) > goto out; > >-- >1.7.11.4 >
diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c index 6ad4a07..569124b 100644 --- a/drivers/media/rc/ir-lirc-codec.c +++ b/drivers/media/rc/ir-lirc-codec.c @@ -140,7 +140,7 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf, goto out; } - ret = dev->tx_ir(dev, txbuf, (u32)n); + ret = dev->tx_ir(dev, txbuf, count); if (ret < 0) goto out;
"[media] rc-core: move timeout and checks to lirc" introduced a buffer overrun by passing the number of bytes, rather than the number of samples, to the transmit function. Signed-off-by: Sean Young <sean@mess.org> --- drivers/media/rc/ir-lirc-codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)