From patchwork Wed Oct 6 22:05:48 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 237251 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id o96MGa89017791 for ; Wed, 6 Oct 2010 22:16:37 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759170Ab0JFWQE (ORCPT ); Wed, 6 Oct 2010 18:16:04 -0400 Received: from smtp.outflux.net ([198.145.64.163]:34250 "EHLO smtp.outflux.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758178Ab0JFWQD (ORCPT ); Wed, 6 Oct 2010 18:16:03 -0400 X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter1.kernel.org [140.211.167.41]); Wed, 06 Oct 2010 22:16:38 +0000 (UTC) X-Greylist: delayed 580 seconds by postgrey-1.27 at vger.kernel.org; Wed, 06 Oct 2010 18:16:03 EDT Received: from www.outflux.net (serenity-end.outflux.net [10.2.0.2]) by vinyl.outflux.net (8.14.3/8.14.3/Debian-9.1ubuntu1) with ESMTP id o96M5m40005653; Wed, 6 Oct 2010 15:05:49 -0700 Date: Wed, 6 Oct 2010 15:05:48 -0700 From: Kees Cook To: linux-kernel@vger.kernel.org Cc: linux-media@vger.kernel.org, Mauro Carvalho Chehab , Devin Heitmueller , Hans Verkuil , Laurent Pinchart Subject: [PATCH] video: fix potential use-before-NULL-check crash Message-ID: <20101006220548.GV14666@outflux.net> MIME-Version: 1.0 Content-Disposition: inline Organization: Canonical X-MIMEDefang-Filter: outflux$Revision: 1.316 $ X-HELO: www.outflux.net X-Scanned-By: MIMEDefang 2.67 on 10.2.0.1 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c index 7b9ec6e..95a4b60 100644 --- a/drivers/media/video/em28xx/em28xx-video.c +++ b/drivers/media/video/em28xx/em28xx-video.c @@ -277,12 +277,13 @@ static void em28xx_copy_vbi(struct em28xx *dev, { void *startwrite, *startread; int offset; - int bytesperline = dev->vbi_width; + int bytesperline; if (dev == NULL) { em28xx_isocdbg("dev is null\n"); return; } + bytesperline = dev->vbi_width; if (dma_q == NULL) { em28xx_isocdbg("dma_q is null\n");