V4L/DVB (8207): uvcvideo: Fix a buffer overflow in format descriptor parsing

Thanks to Oliver Neukum for catching and reporting this bug.

Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 2 insertions, 1 deletions

diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 60ced589f898..86bb16d00173 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -298,7 +298,8 @@ static int uvc_parse_format(struct uvc_device *dev,
         switch (buffer[2]) {
         case VS_FORMAT_UNCOMPRESSED:
         case VS_FORMAT_FRAME_BASED:
-                if (buflen < 27) {
+                n = buffer[2] == VS_FORMAT_UNCOMPRESSED ? 27 : 28;
+                if (buflen < n) {
                         uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming"
                                "interface %d FORMAT error\n",
                                dev->udev->devnum,