From: Haogang Chen Date: Tue, 29 Nov 2011 21:32:25 +0000 (-0300) Subject: [media] uvcvideo: Fix integer overflow in uvc_ioctl_ctrl_map() X-Git-Tag: v3.3-rc1~48^2~430 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=806e23e95f94a27ee445022d724060b9b45cb64a;p=pandora-kernel.git [media] uvcvideo: Fix integer overflow in uvc_ioctl_ctrl_map() There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a large xmap->menu_count is passed from the userspace, the subsequent call to kmalloc() will allocate a buffer smaller than expected. map->menu_count and map->menu_info would later be used in a loop (e.g. in uvc_query_v4l2_ctrl), which leads to out-of-bound access. The patch checks the ioctl argument and returns -EINVAL for zero or too large values in xmap->menu_count. Signed-off-by: Haogang Chen [laurent.pinchart@ideasonboard.com Prevent excessive memory consumption] Signed-off-by: Laurent Pinchart Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab --- Reading git-diff-tree failed