staging: bcm2835-camera: Fix buffer overflow calculation on query of camera properties

The code that queries properties on the camera has a check
for buffer overruns if the firmware sends too much data.  This
check is incorrect, and during testing I was seeing stack corruption.

I believe this error can actually happen in normal use, just for
some reason it doesn't appear on 32 bit as often.  So perhaps
it's best for the check to be fixed.

Signed-off-by: Michael Zoran <mzoran@crowfest.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index 41de8956e42196f8dd4e763b87f54d3fe0811d1f..976aa08365f216b61ef068f8b95ee593162f497d 100644 (file)
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -1442,7 +1442,7 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
        }
 
        ret = -rmsg->u.port_parameter_get_reply.status;
-       if (ret) {
+       if (ret || (rmsg->u.port_parameter_get_reply.size > *value_size)) {
                /* Copy only as much as we have space for
                 * but report true size of parameter
                 */