bcm2835-v4l2: Fix buffer overflow problem
authorDave Stevenson <dave.stevenson@raspberrypi.org>
Fri, 10 Mar 2017 14:43:15 +0000 (14:43 +0000)
committerRaspbian kernel package updater <root@raspbian.org>
Sat, 31 Mar 2018 14:45:43 +0000 (15:45 +0100)
commit0798a364c331378ce6b37d6d4c276040505a5417
tree1a7c880457cd3217c89ac9e92bff93e5e61d0578
parent203d1d5d303ea9e8507d1595808d0517b25b36e7
bcm2835-v4l2: Fix buffer overflow problem

https://github.com/raspberrypi/linux/issues/1447
port_parameter_get() failed to account for the header
(u32 id and u32 size) in the size before memcpying
the response into the response buffer, so overrunning
the provided buffer by 8 bytes.

Account for those bytes, and also a belt-and-braces
check to ensure we never copy more than *value_size
bytes into value.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
drivers/media/platform/bcm2835/mmal-vchiq.c