From 8337fc3053f4189fb64d60495ed89df5befa2a6b Mon Sep 17 00:00:00 2001 From: Marton Nemeth Date: Thu, 5 Nov 2009 05:40:46 -0300 Subject: V4L/DVB (13325): gspca - pac7302/pac7311: Fix buffer overrun. The reg_w_seq() function expects the sequence length in entries and not in bytes. One entry in init_7302 and init_7311 is two bytes and not one. Signed-off-by: Marton Nemeth Signed-off-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/gspca/pac7302.c | 2 +- drivers/media/video/gspca/pac7311.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/media/video/gspca') diff --git a/drivers/media/video/gspca/pac7302.c b/drivers/media/video/gspca/pac7302.c index 60d1a31f530..09d3d191d94 100644 --- a/drivers/media/video/gspca/pac7302.c +++ b/drivers/media/video/gspca/pac7302.c @@ -571,7 +571,7 @@ static void sethvflip(struct gspca_dev *gspca_dev) /* this function is called at probe and resume time for pac7302 */ static int sd_init(struct gspca_dev *gspca_dev) { - reg_w_seq(gspca_dev, init_7302, sizeof init_7302); + reg_w_seq(gspca_dev, init_7302, sizeof(init_7302)/2); return 0; } diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c index 82cdd43aada..b1127d94897 100644 --- a/drivers/media/video/gspca/pac7311.c +++ b/drivers/media/video/gspca/pac7311.c @@ -469,7 +469,7 @@ static void sethvflip(struct gspca_dev *gspca_dev) /* this function is called at probe and resume time for pac7311 */ static int sd_init(struct gspca_dev *gspca_dev) { - reg_w_seq(gspca_dev, init_7311, sizeof init_7311); + reg_w_seq(gspca_dev, init_7311, sizeof(init_7311)/2); return 0; } -- cgit v1.2.3