diff options
| author | Jiri Slaby <jirislaby@gmail.com> | 2009-08-08 11:33:58 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-09-15 12:02:04 -0700 |
| commit | 4d62691b609cc4e66e15c8e5b2261ddb6785b7ca (patch) | |
| tree | 4f2fd6544c0ede765d32b26ad7ad138fa632f5d5 /drivers/staging/dream | |
| parent | 58c6d6d1a6ff66d81ad933cdbfbf7064a064e906 (diff) | |
Staging: dream, fix buf overflow
In vfe_send_msg_no_payload there is a wrong struct vfe_message allocation.
It allocates only sizeof(pointer to vfe_message) for a whole structure.
Add a dereference to the sizeof to allocate sizeof(vfe_message).
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/dream')
| -rw-r--r-- | drivers/staging/dream/camera/msm_vfe8x_proc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/dream/camera/msm_vfe8x_proc.c b/drivers/staging/dream/camera/msm_vfe8x_proc.c index bb650134021..5436f712001 100644 --- a/drivers/staging/dream/camera/msm_vfe8x_proc.c +++ b/drivers/staging/dream/camera/msm_vfe8x_proc.c @@ -818,7 +818,7 @@ static void vfe_send_msg_no_payload(enum VFE_MESSAGE_ID id) { struct vfe_message *msg; - msg = kzalloc(sizeof(msg), GFP_ATOMIC); + msg = kzalloc(sizeof(*msg), GFP_ATOMIC); if (!msg) return; |