Messages in this thread Patch in this message |  | | | Date | Wed, 30 Jul 2008 16:59:17 -0700 | | From | Greg KH <> | | Subject | [patch 40/62] V4L: uvcvideo: Fix a buffer overflow in format descriptor parsing |
| |
2.6.26 -stable review patch. If anyone has any objections, please let us know.
------------------ From: Laurent Pinchart <laurent.pinchart@skynet.be> (cherry picked from commit 233548a2fd934a0220db8b1521c0bc88c82e5e53)
V4L: uvcvideo: Fix a buffer overflow in format descriptor parsing
Thanks to Oliver Neukum for catching and reporting this bug.
Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- drivers/media/video/uvc/uvc_driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/media/video/uvc/uvc_driver.c +++ b/drivers/media/video/uvc/uvc_driver.c @@ -298,7 +298,8 @@ static int uvc_parse_format(struct uvc_d switch (buffer[2]) { case VS_FORMAT_UNCOMPRESSED: case VS_FORMAT_FRAME_BASED: - if (buflen < 27) { + n = buffer[2] == VS_FORMAT_UNCOMPRESSED ? 27 : 28; + if (buflen < n) { uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming" "interface %d FORMAT error\n", dev->udev->devnum, --
|  |