Unverified Commit 352d135f authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!2274 cec-api: prevent leaking memory through hole in structure 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhao Wenhui <zhaowenhui8@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/KXJYVBY62KECBSZHWT2GTCGLFF224WDI/ 
 
https://gitee.com/src-openeuler/kernel/issues/I82DIP 
 
Link:https://gitee.com/openeuler/kernel/pulls/2274

 

Reviewed-by: default avatarZucheng Zheng <zhengzucheng@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 898e3932 3617c60e

drivers/media/cec/cec-api.c

+7 −1
Original line number Diff line number Diff line
@@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap, 
	struct cec_log_addrs log_addrs;



	mutex_lock(&adap->lock);

	log_addrs = adap->log_addrs;

	/*

	 * We use memcpy here instead of assignment since there is a

	 * hole at the end of struct cec_log_addrs that an assignment

	 * might ignore. So when we do copy_to_user() we could leak

	 * one byte of memory.

	 */

	memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs));

	if (!adap->is_configured)

		memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID,

		       sizeof(log_addrs.log_addr));