Re: [patch] watchdog: pcwd_usb: overflow in usb_pcwd_send_command()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Nov 07, 2013 at 06:27:29AM -0800, Guenter Roeck wrote:
> On 11/06/2013 11:40 PM, Dan Carpenter wrote:
> >We changed "buf" from being an array of 6 chars to being a pointer this
> >sizeof(buf) needs to be updated as well.
> >
> oops ...
> 
> >Fixes: 2ddb8089a7e5 ('watchdog: pcwd_usb: Use allocated buffer for usb_control_msg')
> >Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> >
> >diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
> >index 53598e8..7031b9b 100644
> >--- a/drivers/watchdog/pcwd_usb.c
> >+++ b/drivers/watchdog/pcwd_usb.c
> >@@ -258,7 +258,7 @@ static int usb_pcwd_send_command(struct usb_pcwd_private *usb_pcwd,
> >
> >  	if (usb_control_msg(usb_pcwd->udev, usb_sndctrlpipe(usb_pcwd->udev, 0),
> >  			HID_REQ_SET_REPORT, HID_DT_REPORT,
> >-			0x0200, usb_pcwd->interface_number, buf, sizeof(buf),
> >+			0x0200, usb_pcwd->interface_number, buf, 6,
> >  			USB_COMMAND_TIMEOUT) != sizeof(buf)) {
> 
> Doesn't it have to be fixed here as well ?

Yeah.  Good eye.  I'll send a v2.

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe linux-watchdog" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [eCos]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux