linux-kernel - [PATCH -next] media: rkvdec: Fix memset size error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220617073101.101234-1-zhangzekun11@huawei.com>
Date:   Fri, 17 Jun 2022 07:31:01 +0000
From:   Zhang Zekun <zhangzekun11@...wei.com>
To:     <ezequiel@...guardiasur.com.ar>, <mchehab@...nel.org>,
        <gregkh@...uxfoundation.org>, <andrzej.p@...labora.com>,
        <hverkuil-cisco@...all.nl>
CC:     <linux-media@...r.kernel.org>,
        <linux-rockchip@...ts.infradead.org>,
        <linux-staging@...ts.linux.dev>, <linux-kernel@...r.kernel.org>
Subject: [PATCH -next] media: rkvdec: Fix memset size error

'dma_alloc_coherent()' alloc a 'RKVDEC_VP9_COUNT_SIZE' size area to
'unsigned char *count_tbl', however, the memset() bellow only set
'sizeof(*count_tbl)', which equals to 1, bytes to zero. This can
 cause unexpected error.

Fixes: f25709c4ff15 ("media: rkvdec: Add the VP9 backend")
Signed-off-by: Zhang Zekun <zhangzekun11@...wei.com>
---
 drivers/staging/media/rkvdec/rkvdec-vp9.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/media/rkvdec/rkvdec-vp9.c b/drivers/staging/media/rkvdec/rkvdec-vp9.c
index 311a12656072..3ad303a3de48 100644
--- a/drivers/staging/media/rkvdec/rkvdec-vp9.c
+++ b/drivers/staging/media/rkvdec/rkvdec-vp9.c
@@ -1026,7 +1026,7 @@ static int rkvdec_vp9_start(struct rkvdec_ctx *ctx)
 
 	vp9_ctx->count_tbl.size = RKVDEC_VP9_COUNT_SIZE;
 	vp9_ctx->count_tbl.cpu = count_tbl;
-	memset(count_tbl, 0, sizeof(*count_tbl));
+	memset(count_tbl, 0, RKVDEC_VP9_COUNT_SIZE);
 	rkvdec_init_v4l2_vp9_count_tbl(ctx);
 
 	return 0;
-- 
2.17.1