media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args()
commit 4e768c8e upstream. The v4l2_compat_get_array_args() function can leave uninitialized memory in the buffer it is passed. So zero it before copying array elements from userspace into the buffer. Signed-off-by:Hans Verkuil <hverkuil-cisco@xs4all.nl> Reported-by:
<syzbot+ff18193ff05f3f87f226@syzkaller.appspotmail.com> Reviewed-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Loading
Please register or sign in to comment