DivestOS/Patches/Linux_CVEs/CVE-2014-9895/0.patch

34 lines
1.2 KiB
Diff

From cc4b26575602e492efd986e9a6ffc4278cee53b5 Mon Sep 17 00:00:00 2001
From: Deva Ramasubramanian <dramasub@codeaurora.org>
Date: Fri, 24 Jan 2014 12:38:37 -0800
Subject: [media] media: Init the reserved fields of struct media_link_desc
struct media_link_desc is copy_to_user'ed as the return value of
MEDIA_IOC_ENUM_LINKS. When copying, the driver is omitting to initialise
the reserved fields. This commit fixes that by initialising the
reserved fields to 0.
CRs-Fixed: 570757
Change-Id: I230e2666c0845cc36399518a0f2c94db664382d1
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
---
drivers/media/media-device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index 6f9eb94..4f39838 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -139,7 +139,7 @@ static long media_device_enum_links(struct media_device *mdev,
unsigned int p;
for (p = 0; p < entity->num_pads; p++) {
- struct media_pad_desc pad;
+ struct media_pad_desc pad = {0};
media_device_kpad_to_upad(&entity->pads[p], &pad);
if (copy_to_user(&links.pads[p], &pad, sizeof(pad)))
return -EFAULT;
--
cgit v1.1