Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 233548a2 authored Jul 04, 2008 by Laurent Pinchart Committed by Mauro Carvalho Chehab Jul 20, 2008

V4L/DVB (8207): uvcvideo: Fix a buffer overflow in format descriptor parsing



Thanks to Oliver Neukum for catching and reporting this bug.

Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

parent 553b9fa4

drivers/media/video/uvc/uvc_driver.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -298,7 +298,8 @@ static int uvc_parse_format(struct uvc_device *dev,
		switch (buffer[2]) {
		case VS_FORMAT_UNCOMPRESSED:
		case VS_FORMAT_FRAME_BASED:
		if (buflen < 27) {
		n = buffer[2] == VS_FORMAT_UNCOMPRESSED ? 27 : 28;
		if (buflen < n) {
		uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming"
		"interface %d FORMAT error\n",
		dev->udev->devnum,