diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-01-05 02:27:57 -0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2012-01-25 13:53:21 -0800 |
| commit | 537400450bd43daf3f99efe35efd0ccaf16f38b1 (patch) | |
| tree | 318eb8b1dabb23a4080f54cfbfc5531b8e0dbf16 /drivers | |
| parent | adafb366fb48fba6384818fa117ac89ce4ea75a8 (diff) | |
V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()
commit 6c06108be53ca5e94d8b0e93883d534dd9079646 upstream.
If ctrls->count is too high the multiplication could overflow and
array_size would be lower than expected. Mauro and Hans Verkuil
suggested that we cap it at 1024. That comes from the maximum
number of controls with lots of room for expantion.
$ grep V4L2_CID include/linux/videodev2.h | wc -l
211
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/video/v4l2-ioctl.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c index 265bfb537fb7..d7332c758064 100644 --- a/drivers/media/video/v4l2-ioctl.c +++ b/drivers/media/video/v4l2-ioctl.c @@ -414,6 +414,9 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg, p->error_idx = p->count; user_ptr = (void __user *)p->controls; if (p->count) { + err = -EINVAL; + if (p->count > V4L2_CID_MAX_CTRLS) + goto out_ext_ctrl; ctrls_size = sizeof(struct v4l2_ext_control) * p->count; /* Note: v4l2_ext_controls fits in sbuf[] so mbuf is still NULL. */ mbuf = kmalloc(ctrls_size, GFP_KERNEL); @@ -1912,6 +1915,9 @@ long video_ioctl2(struct file *file, p->error_idx = p->count; user_ptr = (void __user *)p->controls; if (p->count) { + err = -EINVAL; + if (p->count > V4L2_CID_MAX_CTRLS) + goto out_ext_ctrl; ctrls_size = sizeof(struct v4l2_ext_control) * p->count; /* Note: v4l2_ext_controls fits in sbuf[] so mbuf is still NULL. */ mbuf = kmalloc(ctrls_size, GFP_KERNEL); |