From: Xi Wang <xi.wang@gmail.com>
Date: Fri, 6 Apr 2012 12:32:37 +0000 (-0300)
Subject: [media] v4l2-ctrls: fix integer overflow in try_set_ext_ctrls()
X-Git-Tag: v3.5-rc1~104^2~405
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0a3475eb618321013dab9ac744201ed09e8061f9;p=pandora-kernel.git

[media] v4l2-ctrls: fix integer overflow in try_set_ext_ctrls()

A large cs->count from userspace may overflow the allocation size,
leading to memory corruption.  try_set_ext_ctrls() can be reached
from subdev_do_ioctl() or __video_do_ioctl().

Use kmalloc_array() to avoid the overflow.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---

Reading git-diff-tree failed