Commit cc73b4b5 authored by Jarod Wilson's avatar Jarod Wilson Committed by Mauro Carvalho Chehab

[media] tm6000: fix vbuf may be used uninitialized

In commit 8aff8ba9, most of the manipulations to vbuf inside
copy_streams were gated on if !dev->radio, but one place that touches
vbuf lays outside those gates -- a memcpy of vbuf isn't NULL. If we
initialize vbuf to NULL, that memcpy will never happen in the case where
we do have dev->radio, and otherwise, in the !dev->radio case, the code
behaves exactly like it did prior to 8aff8ba9.

While we're at it, also fix an incorrectly indented closing brace for
one of the sections touching vbuf that is conditional on !dev->radio.
Signed-off-by: default avatarJarod Wilson <jarod@redhat.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 990528eb
...@@ -228,7 +228,7 @@ static int copy_streams(u8 *data, unsigned long len, ...@@ -228,7 +228,7 @@ static int copy_streams(u8 *data, unsigned long len,
unsigned long header = 0; unsigned long header = 0;
int rc = 0; int rc = 0;
unsigned int cmd, cpysize, pktsize, size, field, block, line, pos = 0; unsigned int cmd, cpysize, pktsize, size, field, block, line, pos = 0;
struct tm6000_buffer *vbuf; struct tm6000_buffer *vbuf = NULL;
char *voutp = NULL; char *voutp = NULL;
unsigned int linewidth; unsigned int linewidth;
...@@ -318,7 +318,7 @@ static int copy_streams(u8 *data, unsigned long len, ...@@ -318,7 +318,7 @@ static int copy_streams(u8 *data, unsigned long len,
if (pos + size > vbuf->vb.size) if (pos + size > vbuf->vb.size)
cmd = TM6000_URB_MSG_ERR; cmd = TM6000_URB_MSG_ERR;
dev->isoc_ctl.vfield = field; dev->isoc_ctl.vfield = field;
} }
break; break;
case TM6000_URB_MSG_VBI: case TM6000_URB_MSG_VBI:
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment