From patchwork Thu Aug 23 21:18:25 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Sean Young X-Patchwork-Id: 1368991 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 8D6C13FC66 for ; Thu, 23 Aug 2012 21:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756045Ab2HWVS2 (ORCPT ); Thu, 23 Aug 2012 17:18:28 -0400 Received: from pequod.mess.org ([93.97.41.153]:41194 "EHLO pequod.mess.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755136Ab2HWVS2 (ORCPT ); Thu, 23 Aug 2012 17:18:28 -0400 Received: by pequod.mess.org (Postfix, from userid 1000) id 060E315FC4; Thu, 23 Aug 2012 22:18:26 +0100 (BST) From: Sean Young To: Mauro Carvalho Chehab , Jarod Wilson , linux-media@vger.kernel.org Cc: =?UTF-8?q?David=20H=C3=A4rdeman?= Subject: [PATCH] [media] rc: fix buffer overrun Date: Thu, 23 Aug 2012 22:18:25 +0100 Message-Id: <1345756705-17576-1-git-send-email-sean@mess.org> X-Mailer: git-send-email 1.7.2.5 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org "[media] rc-core: move timeout and checks to lirc" introduced a buffer overrun by passing the number of bytes, rather than the number of samples, to the transmit function. Signed-off-by: Sean Young Acked-by: David Härdeman --- drivers/media/rc/ir-lirc-codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c index 6ad4a07..569124b 100644 --- a/drivers/media/rc/ir-lirc-codec.c +++ b/drivers/media/rc/ir-lirc-codec.c @@ -140,7 +140,7 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf, goto out; } - ret = dev->tx_ir(dev, txbuf, (u32)n); + ret = dev->tx_ir(dev, txbuf, count); if (ret < 0) goto out;