shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-03 01:36:52 +09:00
Code Issues Packages Projects Releases Wiki Activity

usb gadget: uvc: uvc_request_data::length field must be signed

Browse Source 
commit 6f6543f53f upstream.

The field is used to pass the UVC request data length, but can also be
used to signal an error when setting it to a negative value. Switch from
unsigned int to __s32.

Reported-by: Fernandez Gonzalo <gfernandez@copreci.es>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Laurent Pinchart
2012-04-24 11:29:42 +02:00
committed by Greg Kroah-Hartman
parent 06200304e7
commit 1cb1976ecd
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/usb/gadget/uvc.h
View File

@@ -29,7 +29,7 @@
struct uvc_request_data
{
unsigned int length;
__s32 length;
__u8 data[60];
};

2
drivers/usb/gadget/uvc_v4l2.c
View File

@@ -41,7 +41,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data)
if (data->length < 0)
return usb_ep_set_halt(cdev->gadget->ep0);
req->length = min(uvc->event_length, data->length);
req->length = min_t(unsigned int, uvc->event_length, data->length);
req->zero = data->length < uvc->event_length;
req->dma = DMA_ADDR_INVALID;