Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9329e7b0 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab
Browse files

media: vivid: potential integer overflow in vidioc_g_edid() 



If we pick a very large "edid->blocks" value then the "edid->start_block
+ edid->blocks" addition could wrap around.

Fixes: ef834f78 ("[media] vivid: add the video capture and output parts")

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
parent a3d71f25

drivers/media/platform/vivid/vivid-vid-common.c

+1 −1
Original line number Diff line number Diff line
@@ -860,7 +860,7 @@ int vidioc_g_edid(struct file *file, void *_fh, 
		return -ENODATA;

	if (edid->start_block >= dev->edid_blocks)

		return -EINVAL;

	if (edid->start_block + edid->blocks > dev->edid_blocks)

	if (edid->blocks > dev->edid_blocks - edid->start_block)

		edid->blocks = dev->edid_blocks - edid->start_block;

	if (adap)

		cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);