diff options
| author | Haogang Chen <haogangchen@gmail.com> | 2011-11-29 18:32:25 -0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2012-01-25 17:24:50 -0800 |
| commit | 087bc746ef05511c3e416846a8eae4588756462c (patch) | |
| tree | c0d1c48dbc486fcf77c5c1910eff701ef58cdb32 /fs/dcache.c | |
| parent | 9d3f99878bf33d36739bd772c7dafcb1f71387fb (diff) | |
| download | kernel_samsung_smdk4412-087bc746ef05511c3e416846a8eae4588756462c.zip kernel_samsung_smdk4412-087bc746ef05511c3e416846a8eae4588756462c.tar.gz kernel_samsung_smdk4412-087bc746ef05511c3e416846a8eae4588756462c.tar.bz2 | |
uvcvideo: Fix integer overflow in uvc_ioctl_ctrl_map()
commit 806e23e95f94a27ee445022d724060b9b45cb64a upstream.
There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a
large xmap->menu_count is passed from the userspace, the subsequent call
to kmalloc() will allocate a buffer smaller than expected.
map->menu_count and map->menu_info would later be used in a loop (e.g.
in uvc_query_v4l2_ctrl), which leads to out-of-bound access.
The patch checks the ioctl argument and returns -EINVAL for zero or too
large values in xmap->menu_count.
Signed-off-by: Haogang Chen <haogangchen@gmail.com>
[laurent.pinchart@ideasonboard.com Prevent excessive memory consumption]
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'fs/dcache.c')
0 files changed, 0 insertions, 0 deletions