usb: gadget: uvc: use capped length value
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 14 Mar 2013 08:01:05 +0000 (11:01 +0300)
committerFelipe Balbi <balbi@ti.com>
Mon, 18 Mar 2013 09:18:25 +0000 (11:18 +0200)
"req->length" is a capped version of "data->length".

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
drivers/usb/gadget/uvc_v4l2.c

index a6c728ab6abae8c4286a7a3694962b06ef1a5aac..bb140dd931645b8f75b56b3602865a4404e7b2ea 100644 (file)
@@ -42,7 +42,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data)
        req->length = min_t(unsigned int, uvc->event_length, data->length);
        req->zero = data->length < uvc->event_length;
 
-       memcpy(req->buf, data->data, data->length);
+       memcpy(req->buf, data->data, req->length);
 
        return usb_ep_queue(cdev->gadget->ep0, req, GFP_KERNEL);
 }