projects / platform / kernel / linux-starfive.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 3fc82fa) | patch
[media] zoran: fix integer overflow in setup_window()
authorXi Wang <xi.wang@gmail.com>
Mon, 9 Apr 2012 20:15:45 +0000 (17:15 -0300)
committerMauro Carvalho Chehab <mchehab@redhat.com>
Thu, 19 Apr 2012 12:11:25 +0000 (09:11 -0300)
commit32898a145404acbebe3256709e012c2830a2043b
treefb62bbd35c0936e59daf533624cf7372c49d847atree | snapshot
parent3fc82fa001cac8f22e7493a02c795f2bb33cafaccommit | diff
[media] zoran: fix integer overflow in setup_window()

`clipcount' is from userspace and thus needs validation.  Otherwise,
a large `clipcount' could overflow the vmalloc() size, leading to
out-of-bounds access.

| setup_window()
| zoran_s_fmt_vid_overlay()
| __video_do_ioctl()
| video_ioctl2()

Use 2048 as the maximum `clipcount'.  Also change the corresponding
parameter type to `unsigned int'.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/media/video/zoran/zoran_driver.c diff | blob | history
Domain: System / Kernel;