summaryrefslogtreecommitdiff
path: root/drivers/media/rc/winbond-cir.c
diff options
context:
space:
mode:
authorSean Young <sean@mess.org>2017-08-04 13:33:41 +0300
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2017-08-20 16:52:04 +0300
commit4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3 (patch)
treec65bb10255e99db2865e74a188ee9e94356efdee /drivers/media/rc/winbond-cir.c
parentff05cf0937ad9c88bcfffd5d871918dc1827d989 (diff)
downloadlinux-4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3.tar.xz
media: winbond-cir: buffer overrun during transmit
We're reading beyond the buffer before checking its length. BUG: KASAN: slab-out-of-bounds in wbcir_irq_tx Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/rc/winbond-cir.c')
-rw-r--r--drivers/media/rc/winbond-cir.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
index ea7be6d35ff8..a18eb232ed81 100644
--- a/drivers/media/rc/winbond-cir.c
+++ b/drivers/media/rc/winbond-cir.c
@@ -429,7 +429,7 @@ wbcir_irq_tx(struct wbcir_data *data)
bytes[used] = byte;
}
- while (data->txbuf[data->txoff] == 0 && data->txoff != data->txlen)
+ while (data->txoff != data->txlen && data->txbuf[data->txoff] == 0)
data->txoff++;
if (used == 0) {