Commit 1b8b10cc authored Oct 02, 2012 by Hans Verkuil Committed by Mauro Carvalho Chehab Oct 07, 2012

[media] v4l2-ioctl: add blocks check for VIDIOC_SUBDEV_G/S_EDID

The maximum size of an EDID is 32768 bytes, which is 32768 / 128 = 256 blocks.
Return -EINVAL if blocks > 256 to ensure that the memory allocation is sane.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

parent 8a18382c

drivers/media/v4l2-core/v4l2-ioctl.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -2212,6 +2212,10 @@ static int check_array_args(unsigned int cmd, void parg, size_t array_size,
		struct v4l2_subdev_edid *edid = parg;

		if (edid->blocks) {
		if (edid->blocks > 256) {
		ret = -EINVAL;
		break;
		}
		user_ptr = (void __user )edid->edid;
		kernel_ptr = (void )&edid->edid;
		array_size = edid->blocks 128;