From: Xi Wang <xi.wang@gmail.com>
Date: Fri, 6 Apr 2012 12:32:36 +0000 (-0300)
Subject: [media] v4l2-ctrls: fix integer overflow in v4l2_g_ext_ctrls()
X-Git-Tag: v3.5-rc1~104^2~406
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5f0049bd69b96537dc7c02755c169fb4ccca3ddf;p=pandora-kernel.git

[media] v4l2-ctrls: fix integer overflow in v4l2_g_ext_ctrls()

A large cs->count from userspace may overflow the allocation size,
leading to memory corruption.  v4l2_g_ext_ctrls() can be reached
from subdev_do_ioctl() or __video_do_ioctl().

Use kmalloc_array() to avoid the overflow.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---

Reading git-diff-tree failed