V4L/DVB (13325): gspca - pac7302/pac7311: Fix buffer overrun.

The reg_w_seq() function expects the sequence length in entries and not in bytes. One entry in init_7302 and init_7311 is two bytes and not one. Signed-off-by: Marton Nemeth <nm127@freemail.hu> Signed-off-by: Jean-Francois Moine <moinejf@free.fr> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
git-mirror · Dec 5, 2009 · 8337fc3 · 8337fc3
1 parent 4f7309e
commit 8337fc3
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/drivers/media/video/gspca/pac7302.c b/drivers/media/video/gspca/pac7302.c
@@ -571,7 +571,7 @@ static void sethvflip(struct gspca_dev *gspca_dev)
 /* this function is called at probe and resume time for pac7302 */
 static int sd_init(struct gspca_dev *gspca_dev)
 {
-	reg_w_seq(gspca_dev, init_7302, sizeof init_7302);
+	reg_w_seq(gspca_dev, init_7302, sizeof(init_7302)/2);
 
 	return 0;
 }

diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c
@@ -469,7 +469,7 @@ static void sethvflip(struct gspca_dev *gspca_dev)
 /* this function is called at probe and resume time for pac7311 */
 static int sd_init(struct gspca_dev *gspca_dev)
 {
-	reg_w_seq(gspca_dev, init_7311, sizeof init_7311);
+	reg_w_seq(gspca_dev, init_7311, sizeof(init_7311)/2);
 
 	return 0;
 }