Commit 0c8c1ae1 authored by Colin Ian King's avatar Colin Ian King Committed by Mauro Carvalho Chehab

media: v4l2-core: fix uninitialized structure fields being returned to userspace

In the case where v4l2_event_dequeue fails the structure ev is not
being filled and this garbage data from the stack is being copied
to the ev32 structure and being copied back to userspace on the
VIDIOC_DQEVENT_TIME32 ioctl.  Fix this by ensuring the ev structure
is zero'd to ensure uninitialized data is not leaked back.

Addresses-Coverity: ("Uninitialized scalar variable")

Fixes: 1a6c0b36 ("media: v4l2-core: fix VIDIOC_DQEVENT for time64 ABI")
Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Acked-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent baf98b0a
...@@ -394,7 +394,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg) ...@@ -394,7 +394,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg)
case VIDIOC_DQEVENT_TIME32: { case VIDIOC_DQEVENT_TIME32: {
struct v4l2_event_time32 *ev32 = arg; struct v4l2_event_time32 *ev32 = arg;
struct v4l2_event ev; struct v4l2_event ev = { };
if (!(sd->flags & V4L2_SUBDEV_FL_HAS_EVENTS)) if (!(sd->flags & V4L2_SUBDEV_FL_HAS_EVENTS))
return -ENOIOCTLCMD; return -ENOIOCTLCMD;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment