summaryrefslogtreecommitdiffstats
path: root/drivers/media/video/uvc
diff options
context:
space:
mode:
authorLaurent Pinchart <laurent.pinchart@skynet.be>2008-07-04 00:34:59 -0300
committerMauro Carvalho Chehab <mchehab@infradead.org>2008-07-20 07:17:34 -0300
commit233548a2fd934a0220db8b1521c0bc88c82e5e53 (patch)
treeccec004dce951f73add8e3b00f672e0ea091f3bd /drivers/media/video/uvc
parent553b9fa47d67a77f6456bc969891a347bfb323dc (diff)
V4L/DVB (8207): uvcvideo: Fix a buffer overflow in format descriptor parsing
Thanks to Oliver Neukum for catching and reporting this bug. Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Diffstat (limited to 'drivers/media/video/uvc')
-rw-r--r--drivers/media/video/uvc/uvc_driver.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 60ced589f89..86bb16d0017 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -298,7 +298,8 @@ static int uvc_parse_format(struct uvc_device *dev,
switch (buffer[2]) {
case VS_FORMAT_UNCOMPRESSED:
case VS_FORMAT_FRAME_BASED:
- if (buflen < 27) {
+ n = buffer[2] == VS_FORMAT_UNCOMPRESSED ? 27 : 28;
+ if (buflen < n) {
uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming"
"interface %d FORMAT error\n",
dev->udev->devnum,