linux/drivers/media/usb/hdpvr
Niels Dossche 359c27c6dd media: hdpvr: fix error value returns in hdpvr_read
Error return values are supposed to be negative in hdpvr_read. Most
error returns are currently handled via an unsigned integer "ret". When
setting a negative error value to "ret", the value actually becomes a
large positive value, because "ret" is unsigned. Later on, the "ret"
value is returned. But as ssize_t is a 64-bit signed number, the error
return value stays a large positive integer instead of a negative
integer. This can cause an error value to be interpreted as the read
size, which can cause a buffer overread for applications relying on the
returned size.

Fixes: 9aba42efe8 ("V4L/DVB (11096): V4L2 Driver for the Hauppauge HD PVR usb capture device")
Signed-off-by: Niels Dossche <dossche.niels@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-06-27 09:02:50 +01:00
..
hdpvr-control.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 372 2019-06-05 17:37:10 +02:00
hdpvr-core.c media: usb: hdpvr: convert to use i2c_new_client_device() 2020-04-14 11:31:48 +02:00
hdpvr-i2c.c media: usb: hdpvr: convert to use i2c_new_client_device() 2020-04-14 11:31:48 +02:00
hdpvr-video.c media: hdpvr: fix error value returns in hdpvr_read 2022-06-27 09:02:50 +01:00
hdpvr.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 372 2019-06-05 17:37:10 +02:00
Kconfig media: Kconfig: cleanup VIDEO_DEV dependencies 2022-03-18 05:58:35 +01:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00