From patchwork Sun Feb 14 15:23:07 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans de Goede X-Patchwork-Id: 8302221 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 316DA9F372 for ; Sun, 14 Feb 2016 15:23:39 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 60CA3203C2 for ; Sun, 14 Feb 2016 15:23:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 768D4203A9 for ; Sun, 14 Feb 2016 15:23:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751445AbcBNPXQ (ORCPT ); Sun, 14 Feb 2016 10:23:16 -0500 Received: from mx1.redhat.com ([209.132.183.28]:42000 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751399AbcBNPXN (ORCPT ); Sun, 14 Feb 2016 10:23:13 -0500 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (Postfix) with ESMTPS id AF8D65A4C for ; Sun, 14 Feb 2016 15:23:13 +0000 (UTC) Received: from shalem.localdomain.com (vpn1-7-74.ams2.redhat.com [10.36.7.74]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u1EFNBMG022792; Sun, 14 Feb 2016 10:23:12 -0500 From: Hans de Goede To: Linux Media Mailing List Cc: Hans de Goede Subject: [PATCH tvtime 1/2] Fix array out of bounds access in kdetv filter plugins Date: Sun, 14 Feb 2016 16:23:07 +0100 Message-Id: <1455463388-23954-1-git-send-email-hdegoede@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This is a read-only oob access to data on the stack, so likely harmless, but still lets fix it. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=876948 Signed-off-by: Hans de Goede --- plugins/kdetv_greedyh.c | 2 +- plugins/kdetv_tomsmocomp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/kdetv_greedyh.c b/plugins/kdetv_greedyh.c index c567767..f97fd6d 100644 --- a/plugins/kdetv_greedyh.c +++ b/plugins/kdetv_greedyh.c @@ -40,7 +40,7 @@ static void deinterlace_frame_di_greedyh( uint8_t *output, int outstride, int width, int height ) { TDeinterlaceInfo Info; - TPicture Picture[ 8 ]; + TPicture Picture[ MAX_PICTURE_HISTORY ]; int stride = (width*2); int i; diff --git a/plugins/kdetv_tomsmocomp.c b/plugins/kdetv_tomsmocomp.c index 4f78f3e..b16cf10 100644 --- a/plugins/kdetv_tomsmocomp.c +++ b/plugins/kdetv_tomsmocomp.c @@ -39,7 +39,7 @@ static void deinterlace_frame_di_tomsmocomp( uint8_t *output, int outstride, int width, int height ) { TDeinterlaceInfo Info; - TPicture Picture[ 8 ]; + TPicture Picture[ MAX_PICTURE_HISTORY ]; int stride = (width*2); int i;