lkml.org 
[lkml]   [2008]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 40/62] V4L: uvcvideo: Fix a buffer overflow in format descriptor parsing
    2.6.26 -stable review patch.  If anyone has any objections, please let
    us know.

    ------------------
    From: Laurent Pinchart <laurent.pinchart@skynet.be>

    (cherry picked from commit 233548a2fd934a0220db8b1521c0bc88c82e5e53)

    V4L: uvcvideo: Fix a buffer overflow in format descriptor parsing

    Thanks to Oliver Neukum for catching and reporting this bug.

    Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
    Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/media/video/uvc/uvc_driver.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/media/video/uvc/uvc_driver.c
    +++ b/drivers/media/video/uvc/uvc_driver.c
    @@ -298,7 +298,8 @@ static int uvc_parse_format(struct uvc_d
    switch (buffer[2]) {
    case VS_FORMAT_UNCOMPRESSED:
    case VS_FORMAT_FRAME_BASED:
    - if (buflen < 27) {
    + n = buffer[2] == VS_FORMAT_UNCOMPRESSED ? 27 : 28;
    + if (buflen < n) {
    uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming"
    "interface %d FORMAT error\n",
    dev->udev->devnum,
    --


    \
     
     \ /
      Last update: 2008-07-31 02:23    [W:0.105 / U:0.180 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site