Skip to content

Commit

Permalink
drivers/video/isx012: Fix buffer overrun of isx012_putreg()
Browse files Browse the repository at this point in the history
The maximum size of ISX012 register is 4 bytes.
So, extend temporary buffer size.

Detected by CodeSonar 141893
  • Loading branch information
SPRESENSE committed Mar 11, 2024
1 parent 7e7f4f8 commit 8f3450b
Showing 1 changed file with 8 additions and 6 deletions.
14 changes: 8 additions & 6 deletions drivers/video/isx012.c
Original file line number Diff line number Diff line change
Expand Up @@ -216,7 +216,7 @@ typedef struct isx012_dev_s isx012_dev_t;
static uint16_t isx012_getreg(FAR isx012_dev_t *priv,
uint16_t regaddr, uint16_t regsize);
static int isx012_putreg(FAR isx012_dev_t *priv, uint16_t regaddr,
uint16_t regval, uint16_t regsize);
uint32_t regval, uint16_t regsize);
static int isx012_putreglist(FAR isx012_dev_t *priv,
FAR const isx012_reg_t *reglist, size_t nentries);
#ifdef ISX012_CHECK_IN_DETAIL
Expand Down Expand Up @@ -676,8 +676,8 @@ static uint16_t isx012_getreg(FAR isx012_dev_t *priv,
uint16_t regaddr, uint16_t regsize)
{
struct i2c_config_s config;
volatile uint16_t regval = 0;
volatile uint8_t buffer[2];
uint16_t regval = 0;
uint8_t buffer[2];
int ret;

/* Set up the I2C configuration */
Expand Down Expand Up @@ -719,12 +719,14 @@ static uint16_t isx012_getreg(FAR isx012_dev_t *priv,
}

static int isx012_putreg(FAR isx012_dev_t *priv,
uint16_t regaddr, uint16_t regval, uint16_t regsize)
uint16_t regaddr, uint32_t regval, uint16_t regsize)
{
struct i2c_config_s config;
volatile uint8_t buffer[4];
uint8_t buffer[6];
int ret;

DEBUGASSERT(regsize <= 4);

/* Set up the I2C configuration */

config.frequency = priv->i2c_freq;
Expand Down Expand Up @@ -779,7 +781,7 @@ static int isx012_chk_int_state(FAR isx012_dev_t *priv,
uint32_t wait_time, uint32_t timeout)
{
int ret = 0;
volatile uint8_t data;
uint8_t data;
uint32_t time = 0;

nxsig_usleep(delay_time * 1000);
Expand Down

0 comments on commit 8f3450b

Please sign in to comment.