From 586c61fd88655dfb8373ad96c03464c494667952 Mon Sep 17 00:00:00 2001 From: Sean Young Date: Thu, 23 Aug 2012 17:18:25 -0300 Subject: [PATCH] [media] rc: fix buffer overrun MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "[media] rc-core: move timeout and checks to lirc" introduced a buffer overrun by passing the number of bytes, rather than the number of samples, to the transmit function. Signed-off-by: Sean Young Acked-by: David Härdeman Signed-off-by: Mauro Carvalho Chehab --- drivers/media/rc/ir-lirc-codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c index 6ad4a0770613..569124b03de3 100644 --- a/drivers/media/rc/ir-lirc-codec.c +++ b/drivers/media/rc/ir-lirc-codec.c @@ -140,7 +140,7 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf, goto out; } - ret = dev->tx_ir(dev, txbuf, (u32)n); + ret = dev->tx_ir(dev, txbuf, count); if (ret < 0) goto out;