patch-2.4.21 linux-2.4.21/drivers/usb/mdc800.c

• Lines: 57
• Date: 2003-06-13 07:51:36.000000000 -0700
• Orig file: linux-2.4.20/drivers/usb/mdc800.c
• Orig date: 2002-11-28 15:53:14.000000000 -0800

diff -urN linux-2.4.20/drivers/usb/mdc800.c linux-2.4.21/drivers/usb/mdc800.c
@@ -726,7 +726,7 @@
 		else
 		{
 			/* memcpy Bytes */
-			memcpy (ptr, &mdc800->out [mdc800->out_ptr], sts);
+			copy_to_user(ptr, &mdc800->out [mdc800->out_ptr], sts);
 			ptr+=sts;
 			left-=sts;
 			mdc800->out_ptr+=sts;
@@ -763,14 +763,21 @@
 
 	while (i<len)
 	{
+		unsigned char c;
 		if (signal_pending (current)) 
 		{
 			up (&mdc800->io_lock);
 			return -EINTR;
 		}
+		
+		if(get_user(c, buf+i))
+		{
+			up(&mdc800->io_lock);
+			return -EFAULT;
+		}
 
 		/* check for command start */
-		if (buf [i] == (char) 0x55)
+		if (c == 0x55)
 		{
 			mdc800->in_count=0;
 			mdc800->out_count=0;
@@ -781,12 +788,11 @@
 		/* save command byte */
 		if (mdc800->in_count < 8)
 		{
-			mdc800->in[mdc800->in_count]=buf[i];
+			mdc800->in[mdc800->in_count] = c;
 			mdc800->in_count++;
 		}
 		else
 		{
-			err ("Command is to long !\n");
 			up (&mdc800->io_lock);
 			return -EIO;
 		}
@@ -861,8 +867,8 @@
 							return -EIO;
 						}
 
-						/* Write dummy data, (this is ugly but part of the USB Protokoll */
-						/* if you use endpoint 1 as bulk and not as irq */
+						/* Write dummy data, (this is ugly but part of the USB Protocol */
+						/* if you use endpoint 1 as bulk and not as irq) */
 						memcpy (mdc800->out, mdc800->camera_response,8);
 
 						/* This is the interpreted answer */