BUG: cx23885_video_register() uninitialized value passed to v4l2_subdev_call()

BUG: cx23885_video_register() uninitialized value passed to v4l2_subdev_call()

[David T. L. Wong]

Hi all,

   A potential bug is found in cx23885_video_register().

   A tuner_setup struct is passed to v4l2_subdev_call(),
but that struct is not fully initialized, especially for tuner_callback 
member, and eventually tuner_s_type_addr() copy that wrong pointer.
It would particularly cause seg. fault for xc5000 tuner for analog 
frontend when it calls fe->callback at xc5000_TunerReset().


Regards,
David T.L. Wong

Re: BUG: cx23885_video_register() uninitialized value passed to v4l2_subdev_call()

[Steven Toth]

On 10/1/09 3:06 AM, David T. L. Wong wrote:
> Hi all,
>
> A potential bug is found in cx23885_video_register().
>
> A tuner_setup struct is passed to v4l2_subdev_call(),
> but that struct is not fully initialized, especially for tuner_callback
> member, and eventually tuner_s_type_addr() copy that wrong pointer.
> It would particularly cause seg. fault for xc5000 tuner for analog
> frontend when it calls fe->callback at xc5000_TunerReset().

Thanks for raising this.

I also discovered this last Saturday. I have a patch for this which I expect to 
merge shortly.

Regards,

Steve

-- 
Steven Toth - Kernel Labs
http://www.kernellabs.com