mirror of
https://git.yoctoproject.org/meta-ti
synced 2026-07-16 22:38:04 +00:00
Koen Kooi
189ce92b4c
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net> Signed-off-by: Denys Dmytriyenko <denys@ti.com>
63 lines
2.2 KiB
Diff
63 lines
2.2 KiB
Diff
From ea50d13fefca15eb7d541f1830b2361943090063 Mon Sep 17 00:00:00 2001
|
|
From: Haogang Chen <haogangchen@gmail.com>
|
|
Date: Tue, 29 Nov 2011 18:32:25 -0300
|
|
Subject: [PATCH 074/129] uvcvideo: Fix integer overflow in
|
|
uvc_ioctl_ctrl_map()
|
|
|
|
commit 806e23e95f94a27ee445022d724060b9b45cb64a upstream.
|
|
|
|
There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a
|
|
large xmap->menu_count is passed from the userspace, the subsequent call
|
|
to kmalloc() will allocate a buffer smaller than expected.
|
|
map->menu_count and map->menu_info would later be used in a loop (e.g.
|
|
in uvc_query_v4l2_ctrl), which leads to out-of-bound access.
|
|
|
|
The patch checks the ioctl argument and returns -EINVAL for zero or too
|
|
large values in xmap->menu_count.
|
|
|
|
Signed-off-by: Haogang Chen <haogangchen@gmail.com>
|
|
[laurent.pinchart@ideasonboard.com Prevent excessive memory consumption]
|
|
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
|
|
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
|
|
---
|
|
drivers/media/video/uvc/uvc_v4l2.c | 9 +++++++++
|
|
drivers/media/video/uvc/uvcvideo.h | 1 +
|
|
2 files changed, 10 insertions(+)
|
|
|
|
diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
|
|
index dadf11f..cf7788f 100644
|
|
--- a/drivers/media/video/uvc/uvc_v4l2.c
|
|
+++ b/drivers/media/video/uvc/uvc_v4l2.c
|
|
@@ -58,6 +58,15 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
|
|
break;
|
|
|
|
case V4L2_CTRL_TYPE_MENU:
|
|
+ /* Prevent excessive memory consumption, as well as integer
|
|
+ * overflows.
|
|
+ */
|
|
+ if (xmap->menu_count == 0 ||
|
|
+ xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {
|
|
+ ret = -EINVAL;
|
|
+ goto done;
|
|
+ }
|
|
+
|
|
size = xmap->menu_count * sizeof(*map->menu_info);
|
|
map->menu_info = kmalloc(size, GFP_KERNEL);
|
|
if (map->menu_info == NULL) {
|
|
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
|
|
index 4c1392e..bc446ba 100644
|
|
--- a/drivers/media/video/uvc/uvcvideo.h
|
|
+++ b/drivers/media/video/uvc/uvcvideo.h
|
|
@@ -113,6 +113,7 @@
|
|
|
|
/* Maximum allowed number of control mappings per device */
|
|
#define UVC_MAX_CONTROL_MAPPINGS 1024
|
|
+#define UVC_MAX_CONTROL_MENU_ENTRIES 32
|
|
|
|
/* Devices quirks */
|
|
#define UVC_QUIRK_STATUS_INTERVAL 0x00000001
|
|
--
|
|
1.7.9.5
|
|
|