diff options
| author | Ralph Loader <suckfish@ihug.co.nz> | 2008-09-22 20:06:48 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2008-10-04 22:04:32 -0400 |
| commit | fe6c700ff34e68e1eb7991e9c5d18986d0005ac1 (patch) | |
| tree | fcadc38da2054f3d9b25ad3ceb0d89148adcbdd5 /drivers/bluetooth | |
| parent | bda1cda54b7e1654e9416fec76e6342847b25216 (diff) | |
V4L/DVB (9053): fix buffer overflow in uvc-video
There is a buffer overflow in drivers/media/video/uvc/uvc_ctrl.c:
INFO: 0xf2c5ce08-0xf2c5ce0b. First byte 0xa1 instead of 0xcc
INFO: Allocated in uvc_query_v4l2_ctrl+0x3c/0x239 [uvcvideo] age=13 cpu=1 pid=4975
...
A fixed size 8-byte buffer is allocated, and a variable size field is read
into it; there is no particular bound on the size of the field (it is
dependent on hardware and configuration) and it can overflow [also
verified by inserting printk's.]
The patch attempts to size the buffer to the correctly.
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/bluetooth')
0 files changed, 0 insertions, 0 deletions