[media] media: info leak in __media_device_enum_links()
authorDan Carpenter <dan.carpenter@oracle.com>
Sat, 13 Apr 2013 09:32:15 +0000 (06:32 -0300)
committerMauro Carvalho Chehab <mchehab@redhat.com>
Wed, 12 Jun 2013 21:52:45 +0000 (18:52 -0300)
These structs have holes and reserved struct members which aren't
cleared.  I've added a memset() so we don't leak stack information.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/media/media-device.c

index 1957c0df08fdb5717acedbf17162774f8c75dd05..d5a7a135f75d39d5bc2f6fb3366639dd6dc7ee34 100644 (file)
@@ -142,6 +142,8 @@ static long __media_device_enum_links(struct media_device *mdev,
 
                for (p = 0; p < entity->num_pads; p++) {
                        struct media_pad_desc pad;
+
+                       memset(&pad, 0, sizeof(pad));
                        media_device_kpad_to_upad(&entity->pads[p], &pad);
                        if (copy_to_user(&links->pads[p], &pad, sizeof(pad)))
                                return -EFAULT;
@@ -159,6 +161,7 @@ static long __media_device_enum_links(struct media_device *mdev,
                        if (entity->links[l].source->entity != entity)
                                continue;
 
+                       memset(&link, 0, sizeof(link));
                        media_device_kpad_to_upad(entity->links[l].source,
                                                  &link.source);
                        media_device_kpad_to_upad(entity->links[l].sink,