From: Dan Carpenter Date: Thu, 17 May 2018 08:58:25 +0000 (-0400) Subject: media: vivid: potential integer overflow in vidioc_g_edid() X-Git-Tag: v4.19~865^2~35 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=9329e7b03c6998cae2d2ba75dd697b07147f3830;p=platform%2Fkernel%2Flinux-rpi.git media: vivid: potential integer overflow in vidioc_g_edid() If we pick a very large "edid->blocks" value then the "edid->start_block + edid->blocks" addition could wrap around. Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") Signed-off-by: Dan Carpenter Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c index e5914be0e12d..be531caa2cdf 100644 --- a/drivers/media/platform/vivid/vivid-vid-common.c +++ b/drivers/media/platform/vivid/vivid-vid-common.c @@ -860,7 +860,7 @@ int vidioc_g_edid(struct file *file, void *_fh, return -ENODATA; if (edid->start_block >= dev->edid_blocks) return -EINVAL; - if (edid->start_block + edid->blocks > dev->edid_blocks) + if (edid->blocks > dev->edid_blocks - edid->start_block) edid->blocks = dev->edid_blocks - edid->start_block; if (adap) cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);