X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?p=pandora-kernel.git;a=blobdiff_plain;f=drivers%2Fmedia%2Fvideo%2Fuvc%2Fuvc_ctrl.c;fp=drivers%2Fmedia%2Fvideo%2Fuvc%2Fuvc_ctrl.c;h=47c3a557e3c1c8355e8cb4e17b605603d421d870;hp=254d32688843bdc3f0a38a782e13fef2ec8d5a18;hb=fd15ae01c5b1c73f2c992afd219bd18856ae3e48;hpb=483d316f28e1ece50975f3e34256d50b840406ec

diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index 254d32688843..47c3a557e3c1 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -1698,6 +1698,13 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
 		goto done;
 	}
 
+	/* Validate the user-provided bit-size and offset */
+	if (mapping->size > 32 ||
+	    mapping->offset + mapping->size > ctrl->info.size * 8) {
+		ret = -EINVAL;
+		goto done;
+	}
+
 	list_for_each_entry(map, &ctrl->info.mappings, list) {
 		if (mapping->id == map->id) {
 			uvc_trace(UVC_TRACE_CONTROL, "Can't add mapping '%s', "