diff options
| author | Xi Wang <xi.wang@gmail.com> | 2012-04-10 00:15:45 +0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2012-04-19 16:11:25 +0400 |
| commit | 32898a145404acbebe3256709e012c2830a2043b (patch) | |
| tree | fb62bbd35c0936e59daf533624cf7372c49d847a /drivers/usb/core/message.c | |
| parent | 3fc82fa001cac8f22e7493a02c795f2bb33cafac (diff) | |
| download | linux-32898a145404acbebe3256709e012c2830a2043b.tar.xz | |
[media] zoran: fix integer overflow in setup_window()
`clipcount' is from userspace and thus needs validation. Otherwise,
a large `clipcount' could overflow the vmalloc() size, leading to
out-of-bounds access.
| setup_window()
| zoran_s_fmt_vid_overlay()
| __video_do_ioctl()
| video_ioctl2()
Use 2048 as the maximum `clipcount'. Also change the corresponding
parameter type to `unsigned int'.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/usb/core/message.c')
0 files changed, 0 insertions, 0 deletions