summaryrefslogtreecommitdiff
path: root/Makefile
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2016-11-17 10:49:31 +0100
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2016-11-23 21:04:26 -0200
commit22a1e7783e173ab3d86018eb590107d68df46c11 (patch)
tree3beaea52d877cfab058a52b97a2e2f4d6f170b4e /Makefile
parent9c763584b7c8911106bb77af7e648bef09af9d80 (diff)
xc2028: Fix use-after-free bug properly
The commit 8dfbcc4351a0 ("[media] xc2028: avoid use after free") tried to address the reported use-after-free by clearing the reference. However, it's clearing the wrong pointer; it sets NULL to priv->ctrl.fname, but it's anyway overwritten by the next line memcpy(&priv->ctrl, p, sizeof(priv->ctrl)). OTOH, the actual code accessing the freed string is the strcmp() call with priv->fname: if (!firmware_name[0] && p->fname && priv->fname && strcmp(p->fname, priv->fname)) free_firmware(priv); where priv->fname points to the previous file name, and this was already freed by kfree(). For fixing the bug properly, this patch does the following: - Keep the copy of firmware file name in only priv->fname, priv->ctrl.fname isn't changed; - The allocation is done only when the firmware gets loaded; - The kfree() is called in free_firmware() commonly Fixes: commit 8dfbcc4351a0 ('[media] xc2028: avoid use after free') Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'Makefile')
0 files changed, 0 insertions, 0 deletions