From: Gustavo A. R. Silva Date: Thu, 20 Jan 2022 21:24:34 +0000 (-0600) Subject: media: usb: pwc-uncompress: Use struct_size() helper in pwc_decompress() X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=dca4f5fdbcd7dddcd2169be2c3bf3057d51b100e;p=linux.git media: usb: pwc-uncompress: Use struct_size() helper in pwc_decompress() Make use of the struct_size() helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worst scenario, could lead to heap overflows. Also, address the following sparse warnings: drivers/media/usb/pwc/pwc-uncompress.c:44:44: warning: using sizeof on a flexible structure Link: https://github.com/KSPP/linux/issues/174 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Hans Verkuil --- diff --git a/drivers/media/usb/pwc/pwc-uncompress.c b/drivers/media/usb/pwc/pwc-uncompress.c index 68bc3829c6b34..faf44cdeb2688 100644 --- a/drivers/media/usb/pwc/pwc-uncompress.c +++ b/drivers/media/usb/pwc/pwc-uncompress.c @@ -41,7 +41,7 @@ int pwc_decompress(struct pwc_device *pdev, struct pwc_frame_buf *fbuf) memcpy(raw_frame->cmd, pdev->cmd_buf, 4); memcpy(raw_frame+1, yuv, pdev->frame_size); vb2_set_plane_payload(&fbuf->vb.vb2_buf, 0, - pdev->frame_size + sizeof(struct pwc_raw_frame)); + struct_size(raw_frame, rawframe, pdev->frame_size)); return 0; }