[3/5] dvb-usb/vp7045: initialize br[]
diff mbox series

Message ID 20191112092228.15800-4-hverkuil-cisco@xs4all.nl
State New
Headers show
Series
  • Fix various syzbot errors
Related show

Commit Message

Hans Verkuil Nov. 12, 2019, 9:22 a.m. UTC
The br[] array was uninitialized, leading to a syzbot error.

Syzbot link:

https://syzkaller.appspot.com/bug?extid=ec869945d3dde5f33b43

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: syzbot+ec869945d3dde5f33b43@syzkaller.appspotmail.com
CC: Sean Young <sean@mess.org>
---
 drivers/media/usb/dvb-usb/vp7045.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Sean Young Nov. 12, 2019, 9:50 a.m. UTC | #1
On Tue, Nov 12, 2019 at 10:22:26AM +0100, Hans Verkuil wrote:
> The br[] array was uninitialized, leading to a syzbot error.
> 
> Syzbot link:
> 
> https://syzkaller.appspot.com/bug?extid=ec869945d3dde5f33b43
> 
> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
> Reported-by: syzbot+ec869945d3dde5f33b43@syzkaller.appspotmail.com
> CC: Sean Young <sean@mess.org>
> ---

The value is unintialized because the usb transfer failed. My solution
actually returns an error.

https://patchwork.linuxtv.org/patch/59985/

Note that in both cases the error won't be fatal, but should be reported.

Sean

>  drivers/media/usb/dvb-usb/vp7045.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/usb/dvb-usb/vp7045.c b/drivers/media/usb/dvb-usb/vp7045.c
> index 80c1cf05384b..3e87adca5be9 100644
> --- a/drivers/media/usb/dvb-usb/vp7045.c
> +++ b/drivers/media/usb/dvb-usb/vp7045.c
> @@ -116,7 +116,7 @@ static int vp7045_rc_query(struct dvb_usb_device *d)
>  static int vp7045_read_eeprom(struct dvb_usb_device *d,u8 *buf, int len, int offset)
>  {
>  	int i = 0;
> -	u8 v,br[2];
> +	u8 v, br[2] = { 0 };
>  	for (i=0; i < len; i++) {
>  		v = offset + i;
>  		vp7045_usb_op(d,GET_EE_VALUE,&v,1,br,2,5);
> -- 
> 2.24.0

Patch
diff mbox series

diff --git a/drivers/media/usb/dvb-usb/vp7045.c b/drivers/media/usb/dvb-usb/vp7045.c
index 80c1cf05384b..3e87adca5be9 100644
--- a/drivers/media/usb/dvb-usb/vp7045.c
+++ b/drivers/media/usb/dvb-usb/vp7045.c
@@ -116,7 +116,7 @@  static int vp7045_rc_query(struct dvb_usb_device *d)
 static int vp7045_read_eeprom(struct dvb_usb_device *d,u8 *buf, int len, int offset)
 {
 	int i = 0;
-	u8 v,br[2];
+	u8 v, br[2] = { 0 };
 	for (i=0; i < len; i++) {
 		v = offset + i;
 		vp7045_usb_op(d,GET_EE_VALUE,&v,1,br,2,5);