diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-06-30 14:56:36 +0800 |
|---|---|---|
| committer | Hans Verkuil <hverkuil+cisco@kernel.org> | 2026-07-15 17:12:55 +0200 |
| commit | bf533acaaa7dee21d49bcaabf8e813ea36bddcd8 (patch) | |
| tree | 916880b11203622486cf201c3950bc6f21588b94 /drivers | |
| parent | 007b61981aa970d314a6042cedcf7ef2cf34bf23 (diff) | |
| download | linux-next-bf533acaaa7dee21d49bcaabf8e813ea36bddcd8.tar.gz linux-next-bf533acaaa7dee21d49bcaabf8e813ea36bddcd8.zip | |
media: cx18: stop VBI start-code scan before short tail
compress_sliced_buf() scans one byte at a time while testing a four-byte
VBI start code. The final iterations can read beyond the remaining
buffer tail.
Stop the scan once fewer than four bytes remain.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/pci/cx18/cx18-vbi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/pci/cx18/cx18-vbi.c b/drivers/media/pci/cx18/cx18-vbi.c index 8dc4ce325935..3a8430f3259e 100644 --- a/drivers/media/pci/cx18/cx18-vbi.c +++ b/drivers/media/pci/cx18/cx18-vbi.c @@ -135,7 +135,7 @@ static u32 compress_sliced_buf(struct cx18 *cx, u8 *buf, u32 size, : VBI_HBLANK_SAMPLES_50HZ; /* find the first valid line */ - for (i = hdr_size, buf += hdr_size; i < size; i++, buf++) { + for (i = hdr_size, buf += hdr_size; i + 3 < size; i++, buf++) { if (buf[0] == 0xff && !buf[1] && !buf[2] && (buf[3] == sliced_vbi_eav_rp[0] || buf[3] == sliced_vbi_eav_rp[1])) |