sergiotarxz/nuttx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

drivers/video/isx012: Fix buffer overrun of isx012_putreg()

Browse Source 
The maximum size of ISX012 register is 4 bytes.
So, extend temporary buffer size.

Detected by CodeSonar 141893
This commit is contained in:
SPRESENSE 2023-12-19 15:25:59 +09:00 committed by Alin Jerpelea
parent 3419f018a4
commit bac0228825
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/video/isx012.c
View File

@ -216,7 +216,7 @@ typedef struct isx012_dev_s isx012_dev_t;
static uint16_t isx012_getreg(FAR isx012_dev_t *priv,
uint16_t regaddr, uint16_t regsize);
static int isx012_putreg(FAR isx012_dev_t *priv, uint16_t regaddr,
uint16_t regval, uint16_t regsize);
uint32_t regval, uint16_t regsize);
static int isx012_putreglist(FAR isx012_dev_t *priv,
FAR const isx012_reg_t *reglist, size_t nentries);
#ifdef ISX012_CHECK_IN_DETAIL
@ -676,8 +676,8 @@ static uint16_t isx012_getreg(FAR isx012_dev_t *priv,
uint16_t regaddr, uint16_t regsize)
{
struct i2c_config_s config;
volatile uint16_t regval = 0;
volatile uint8_t buffer[2];
uint16_t regval = 0;
uint8_t buffer[2];
int ret;
/* Set up the I2C configuration */
@ -719,12 +719,14 @@ static uint16_t isx012_getreg(FAR isx012_dev_t *priv,
}
static int isx012_putreg(FAR isx012_dev_t *priv,
uint16_t regaddr, uint16_t regval, uint16_t regsize)
uint16_t regaddr, uint32_t regval, uint16_t regsize)
{
struct i2c_config_s config;
volatile uint8_t buffer[4];
uint8_t buffer[6];
int ret;
DEBUGASSERT(regsize <= 4);
/* Set up the I2C configuration */
config.frequency = priv->i2c_freq;
@ -779,7 +781,7 @@ static int isx012_chk_int_state(FAR isx012_dev_t *priv,
uint32_t wait_time, uint32_t timeout)
{
int ret = 0;
volatile uint8_t data;
uint8_t data;
uint32_t time = 0;
nxsig_usleep(delay_time * 1000);