• Dan Carpenter's avatar
    [media] ddbridge: fix ddb_ioctl() · e9013fb6
    Dan Carpenter authored
    There were a several problems in this function:
    
    1) Potential integer overflow in the comparison:
    	if (fio.write_len + fio.read_len > 1028) {
    
    2) If the user gave bogus values for write_len and read_len then
       returning -EINVAL is more appropriate than returning -ENOMEM.
    
    3) wbuf was set to the address of an array and could never be NULL
       so I removed the pointless NULL check.
    
    4) The call to vfree(wbuf) was improper.  That array is part of a
       larger struct and isn't allocated by itself.
    
    5) flashio() can't actually fail, but we may as well add error
       handling in case this changes later.
    
    6) In the default case where an ioctl is not implemented then
       returning -ENOTTY is more appropriate than returning -EFAULT.
    Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
    e9013fb6
ddbridge-core.c 41.6 KB