summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorHans Verkuil <hans.verkuil@cisco.com>2012-10-02 02:47:58 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2012-10-07 10:19:34 -0300
commit1b8b10cc7e6bd9bf017c58e32b1e7f632e23850d (patch)
treef5e97c8bbf2bbc0797088f08d34c6f9cd795f202 /drivers
parent8a18382c3196978164f0f6290aac98f2f6f43c00 (diff)
[media] v4l2-ioctl: add blocks check for VIDIOC_SUBDEV_G/S_EDID
The maximum size of an EDID is 32768 bytes, which is 32768 / 128 = 256 blocks. Return -EINVAL if blocks > 256 to ensure that the memory allocation is sane. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/media/v4l2-core/v4l2-ioctl.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 16205d9bddf..11874c170cb 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -2212,6 +2212,10 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
struct v4l2_subdev_edid *edid = parg;
if (edid->blocks) {
+ if (edid->blocks > 256) {
+ ret = -EINVAL;
+ break;
+ }
*user_ptr = (void __user *)edid->edid;
*kernel_ptr = (void *)&edid->edid;
*array_size = edid->blocks * 128;