From: Xi Wang <xi.wang@gmail.com>
Date: Mon, 9 Apr 2012 20:15:45 +0000 (-0300)
Subject: [media] zoran: fix integer overflow in setup_window()
X-Git-Tag: v3.5-rc1~104^2~402
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=32898a145404acbebe3256709e012c2830a2043b;p=pandora-kernel.git

[media] zoran: fix integer overflow in setup_window()

`clipcount' is from userspace and thus needs validation.  Otherwise,
a large `clipcount' could overflow the vmalloc() size, leading to
out-of-bounds access.

| setup_window()
| zoran_s_fmt_vid_overlay()
| __video_do_ioctl()
| video_ioctl2()

Use 2048 as the maximum `clipcount'.  Also change the corresponding
parameter type to `unsigned int'.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---

Reading git-diff-tree failed