tm6000: Don't copy outside the buffer

Commit Message

Mauro Carvalho Chehab May 2, 2010, 11:54 p.m. UTC

None

Patch

diff --git a/drivers/staging/tm6000/tm6000-video.c b/drivers/staging/tm6000/tm6000-video.c
index 3317220..4444487 100644
--- a/drivers/staging/tm6000/tm6000-video.c
+++ b/drivers/staging/tm6000/tm6000-video.c
@@ -358,13 +358,13 @@  static int copy_streams(u8 *data, u8 *out_p, unsigned long len,
 					dev->isoc_ctl.tmp_buf_len--;
 				}
 				if (dev->isoc_ctl.tmp_buf_len) {
-					memcpy (&header,p,
+					memcpy(&header, p,
 						dev->isoc_ctl.tmp_buf_len);
-					memcpy (((u8 *)header)+
-						dev->isoc_ctl.tmp_buf,
+					memcpy((u8 *)&header +
+						dev->isoc_ctl.tmp_buf_len,
 						ptr,
-						4-dev->isoc_ctl.tmp_buf_len);
-					ptr+=4-dev->isoc_ctl.tmp_buf_len;
+						4 - dev->isoc_ctl.tmp_buf_len);
+					ptr += 4 - dev->isoc_ctl.tmp_buf_len;
 					goto HEADER;
 				}
 			}