From: Colin Ian King Date: Tue, 7 Jan 2020 14:02:06 +0000 (+0100) Subject: media: v4l2-core: fix uninitialized structure fields being returned to userspace X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=0c8c1ae155b89be7e0cd7e74494dfc83554c56d2;p=linux.git media: v4l2-core: fix uninitialized structure fields being returned to userspace In the case where v4l2_event_dequeue fails the structure ev is not being filled and this garbage data from the stack is being copied to the ev32 structure and being copied back to userspace on the VIDIOC_DQEVENT_TIME32 ioctl. Fix this by ensuring the ev structure is zero'd to ensure uninitialized data is not leaked back. Addresses-Coverity: ("Uninitialized scalar variable") Fixes: 1a6c0b36dd19 ("media: v4l2-core: fix VIDIOC_DQEVENT for time64 ABI") Signed-off-by: Colin Ian King Acked-by: Arnd Bergmann Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c index de926e3113486..a376b351135f1 100644 --- a/drivers/media/v4l2-core/v4l2-subdev.c +++ b/drivers/media/v4l2-core/v4l2-subdev.c @@ -394,7 +394,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg) case VIDIOC_DQEVENT_TIME32: { struct v4l2_event_time32 *ev32 = arg; - struct v4l2_event ev; + struct v4l2_event ev = { }; if (!(sd->flags & V4L2_SUBDEV_FL_HAS_EVENTS)) return -ENOIOCTLCMD;