media: winbond-cir: buffer overrun during transmit
authorSean Young <sean@mess.org>
Fri, 4 Aug 2017 10:33:41 +0000 (06:33 -0400)
committerMauro Carvalho Chehab <mchehab@s-opensource.com>
Sun, 20 Aug 2017 13:52:04 +0000 (09:52 -0400)
commit4fe055ecfc0a597e19dc159cf5289fd8f18ef9e3
treec65bb10255e99db2865e74a188ee9e94356efdee
parentff05cf0937ad9c88bcfffd5d871918dc1827d989
media: winbond-cir: buffer overrun during transmit

We're reading beyond the buffer before checking its length.

BUG: KASAN: slab-out-of-bounds in wbcir_irq_tx

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
drivers/media/rc/winbond-cir.c