BUG: cx23885_video_register() uninitialized value passed to v4l2_subdev_call()

DISCUSSION David T. L. Wong 2 participants 2 messages Oct 1, 2009 Media (V4L/DVB)

lore

Share & tools

lore

David T. L. Wong

author

2009-10-01 07:13 UTC #0 lore raw

Hi all,

A potential bug is found in cx23885_video_register().

A tuner_setup struct is passed to v4l2_subdev_call(),
but that struct is not fully initialized, especially for tuner_callback member, and eventually tuner_s_type_addr() copy that wrong pointer. It would particularly cause seg. fault for xc5000 tuner for analog frontend when it calls fe->callback at xc5000_TunerReset().

Regards,
David T.L. Wong

Steven Toth

2009-10-01 13:41 UTC #1 lore raw

Quoted 9 lines · David T. L. Wong

Hi all,
A potential bug is found in cx23885_video_register().
A tuner_setup struct is passed to v4l2_subdev_call(),
but that struct is not fully initialized, especially for tuner_callback member, and eventually tuner_s_type_addr() copy that wrong pointer. It would particularly cause seg. fault for xc5000 tuner for analog frontend when it calls fe->callback at xc5000_TunerReset().

Thanks for raising this.

I also discovered this last Saturday. I have a patch for this which I expect to merge shortly.

Regards,

Steve

Signature · 2 lines

Steven Toth - Kernel Labs
http://www.kernellabs.com