forked from Minki/linux
806e23e95f
There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a large xmap->menu_count is passed from the userspace, the subsequent call to kmalloc() will allocate a buffer smaller than expected. map->menu_count and map->menu_info would later be used in a loop (e.g. in uvc_query_v4l2_ctrl), which leads to out-of-bound access. The patch checks the ioctl argument and returns -EINVAL for zero or too large values in xmap->menu_count. Signed-off-by: Haogang Chen <haogangchen@gmail.com> [laurent.pinchart@ideasonboard.com Prevent excessive memory consumption] Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| uvc_ctrl.c | ||
| uvc_debugfs.c | ||
| uvc_driver.c | ||
| uvc_entity.c | ||
| uvc_isight.c | ||
| uvc_queue.c | ||
| uvc_status.c | ||
| uvc_v4l2.c | ||
| uvc_video.c | ||
| uvcvideo.h | ||