[media] v4l2-ctrls: fix integer overflow in try_set_ext_ctrls()

Browse source

A large cs->count from userspace may overflow the allocation size,
leading to memory corruption.  try_set_ext_ctrls() can be reached
from subdev_do_ioctl() or __video_do_ioctl().

Use kmalloc_array() to avoid the overflow.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

...

This commit is contained in:

Xi Wang 2012-04-06 09:32:37 -03:00 • committed by Mauro Carvalho Chehab

parent 5f0049bd69

commit 0a3475eb61

1 changed files with 2 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

drivers/media/video/v4l2-ctrls.c

View file