iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[media] tm6000: fix vbuf may be used uninitialized

Browse Source 
In commit 8aff8ba951, most of the manipulations to vbuf inside
copy_streams were gated on if !dev->radio, but one place that touches
vbuf lays outside those gates -- a memcpy of vbuf isn't NULL. If we
initialize vbuf to NULL, that memcpy will never happen in the case where
we do have dev->radio, and otherwise, in the !dev->radio case, the code
behaves exactly like it did prior to 8aff8ba951.

While we're at it, also fix an incorrectly indented closing brace for
one of the sections touching vbuf that is conditional on !dev->radio.

Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Jarod Wilson 2011-04-11 18:49:24 -03:00 committed by Mauro Carvalho Chehab
parent 990528ebe7
commit cc73b4b57c
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/staging/tm6000/tm6000-video.c
View File

@ -228,7 +228,7 @@ static int copy_streams(u8 *data, unsigned long len,
unsigned long header = 0; unsigned long header = 0;
int rc = 0; int rc = 0;
unsigned int cmd, cpysize, pktsize, size, field, block, line, pos = 0; unsigned int cmd, cpysize, pktsize, size, field, block, line, pos = 0;
struct tm6000_buffer *vbuf; struct tm6000_buffer *vbuf = NULL;
char *voutp = NULL; char *voutp = NULL;
unsigned int linewidth; unsigned int linewidth;
@ -318,7 +318,7 @@ static int copy_streams(u8 *data, unsigned long len,
if (pos + size > vbuf->vb.size) if (pos + size > vbuf->vb.size)
cmd = TM6000_URB_MSG_ERR; cmd = TM6000_URB_MSG_ERR;
dev->isoc_ctl.vfield = field; dev->isoc_ctl.vfield = field;
} }
break; break;
case TM6000_URB_MSG_VBI: case TM6000_URB_MSG_VBI:
break; break;