[15/37] V4L: Fix VIDIOCGAP corruption in ivtv

Greg KH
2008-04-29T17:26:39Z

[-- Attachment #1: v4l-fix-vidiocgap-corruption-in-ivtv.patch --]
[-- Type: text/plain, Size: 1548 bytes --]

2.6.25-stable review patch. If anyone has any objections, please let us
know.

------------------
From: Alan Cox <alan@lxorguk.ukuu.org.uk>

(cherry picked from commit d2b213f7b76f187c4391079c7581d3a08b940133)

Frank Bennett reported that ivtv was causing skype to crash. With help
from one of their developers he showed it was a kernel problem.
VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names
that are too long and does not truncate them so corrupts a few bytes of
the app data area.

Possibly the names also want trimming but for now this should fix the
corruption case.

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/media/video/ivtv/ivtv-ioctl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/media/video/ivtv/ivtv-ioctl.c
+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
@@ -741,7 +741,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, s

memset(vcap, 0, sizeof(*vcap));
strcpy(vcap->driver, IVTV_DRIVER_NAME); /* driver name */
- strcpy(vcap->card, itv->card_name); /* card type */
+ strncpy(vcap->card, itv->card_name,
+ sizeof(vcap->card)-1); /* card type */
strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */
vcap->version = IVTV_DRIVER_VERSION; /* version */
vcap->capabilities = itv->v4l2_cap; /* capabilities */

--