mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-24 04:34:08 +08:00
359c27c6dd
Error return values are supposed to be negative in hdpvr_read. Most
error returns are currently handled via an unsigned integer "ret". When
setting a negative error value to "ret", the value actually becomes a
large positive value, because "ret" is unsigned. Later on, the "ret"
value is returned. But as ssize_t is a 64-bit signed number, the error
return value stays a large positive integer instead of a negative
integer. This can cause an error value to be interpreted as the read
size, which can cause a buffer overread for applications relying on the
returned size.
Fixes:
|
||
|---|---|---|
| .. | ||
| hdpvr-control.c | ||
| hdpvr-core.c | ||
| hdpvr-i2c.c | ||
| hdpvr-video.c | ||
| hdpvr.h | ||
| Kconfig | ||
| Makefile | ||