From patchwork Sun May 2 23:54:16 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 96389 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o42NsqGW004808 for ; Sun, 2 May 2010 23:54:53 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752829Ab0EBXyj (ORCPT ); Sun, 2 May 2010 19:54:39 -0400 Received: from bombadil.infradead.org ([18.85.46.34]:49265 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752418Ab0EBXyi (ORCPT ); Sun, 2 May 2010 19:54:38 -0400 Received: from 201-13-168-84.dial-up.telesp.net.br ([201.13.168.84] helo=[192.168.30.170]) by bombadil.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux)) id 1O8izd-0003v9-JC for linux-media@vger.kernel.org; Sun, 02 May 2010 23:54:37 +0000 Message-ID: <4BDE10A8.4040500@infradead.org> Date: Sun, 02 May 2010 20:54:16 -0300 From: Mauro Carvalho Chehab User-Agent: Thunderbird 2.0.0.22 (X11/20090609) MIME-Version: 1.0 To: "linux-me >> Linux Media Mailing List" Subject: [PATCH] tm6000: Don't copy outside the buffer X-SRS-Rewrite: SMTP reverse-path rewritten from by bombadil.infradead.org See http://www.infradead.org/rpr.html Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Sun, 02 May 2010 23:54:54 +0000 (UTC) diff --git a/drivers/staging/tm6000/tm6000-video.c b/drivers/staging/tm6000/tm6000-video.c index 3317220..4444487 100644 --- a/drivers/staging/tm6000/tm6000-video.c +++ b/drivers/staging/tm6000/tm6000-video.c @@ -358,13 +358,13 @@ static int copy_streams(u8 *data, u8 *out_p, unsigned long len, dev->isoc_ctl.tmp_buf_len--; } if (dev->isoc_ctl.tmp_buf_len) { - memcpy (&header,p, + memcpy(&header, p, dev->isoc_ctl.tmp_buf_len); - memcpy (((u8 *)header)+ - dev->isoc_ctl.tmp_buf, + memcpy((u8 *)&header + + dev->isoc_ctl.tmp_buf_len, ptr, - 4-dev->isoc_ctl.tmp_buf_len); - ptr+=4-dev->isoc_ctl.tmp_buf_len; + 4 - dev->isoc_ctl.tmp_buf_len); + ptr += 4 - dev->isoc_ctl.tmp_buf_len; goto HEADER; } }