"[media] rc-core: move timeout and checks to lirc" introduced a buffer overrun by passing the number of bytes, rather than the number of samples, to the transmit function. Signed-off-by: Sean Young <sean@xxxxxxxx> --- drivers/media/rc/ir-lirc-codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c index 6ad4a07..569124b 100644 --- a/drivers/media/rc/ir-lirc-codec.c +++ b/drivers/media/rc/ir-lirc-codec.c @@ -140,7 +140,7 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf, goto out; } - ret = dev->tx_ir(dev, txbuf, (u32)n); + ret = dev->tx_ir(dev, txbuf, count); if (ret < 0) goto out; -- 1.7.11.4 -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
