diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-01-05 02:27:57 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2012-01-07 11:47:22 -0200 |
| commit | 6c06108be53ca5e94d8b0e93883d534dd9079646 (patch) | |
| tree | 2b2902e6b1c0d91f4fedd804af47ff33dbae42e1 /include/linux/kd.h | |
| parent | e82db75d06ac331ae39b07f57539df3c51d19b94 (diff) | |
[media] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()
If ctrls->count is too high the multiplication could overflow and
array_size would be lower than expected. Mauro and Hans Verkuil
suggested that we cap it at 1024. That comes from the maximum
number of controls with lots of room for expantion.
$ grep V4L2_CID include/linux/videodev2.h | wc -l
211
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'include/linux/kd.h')
0 files changed, 0 insertions, 0 deletions