Unverified Commit 0bb82083 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9004 media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() 

Merge Pull Request from: @ci-robot 
 
PR sync from: liwei <liwei728@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/3RT65KQYQDNBMNWKZYBKINXKHJLL2GCM/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9R4JV 
 
Link:https://gitee.com/openeuler/kernel/pulls/9004

 

Reviewed-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 573bcae0 2a81a717

drivers/media/pci/ngene/ngene-core.c

+1 −1
Original line number Diff line number Diff line
@@ -398,7 +398,7 @@ static int ngene_command_config_free_buf(struct ngene *dev, u8 *config) 


	com.cmd.hdr.Opcode = CMD_CONFIGURE_FREE_BUFFER;

	com.cmd.hdr.Length = 6;

	memcpy(&com.cmd.ConfigureBuffers.config, config, 6);

	memcpy(&com.cmd.ConfigureFreeBuffers.config, config, 6);

	com.in_len = 6;

	com.out_len = 0;

drivers/media/pci/ngene/ngene.h

+8 −6
Original line number Diff line number Diff line
@@ -419,12 +419,14 @@ enum _BUFFER_CONFIGS { 


struct FW_CONFIGURE_FREE_BUFFERS {

	struct FW_HEADER hdr;

	struct {

		u8   UVI1_BufferLength;

		u8   UVI2_BufferLength;

		u8   TVO_BufferLength;

		u8   AUD1_BufferLength;

		u8   AUD2_BufferLength;

		u8   TVA_BufferLength;

	} __packed config;

} __attribute__ ((__packed__));



struct FW_CONFIGURE_UART {