Skip to contentSkip to conversation

omap24xxcam: potential buffer overflow

PATCH In review Dan Carpenter 2 participants 2 messages Mar 10, 2010

Subsystems (2)
Media (V4L/DVB) Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 omap24xxcam: potential buffer overflow

The previous loop goes until last = VIDEO_MAX_FRAME, so this could potentially go one past the end of the loop.

Signed-off-by Dan Carpenter <[email protected]>
drivers/media/video/omap24xxcam.c +1 -1
index 142c327..bedbee9 100644
@@ -1404,7 +1404,7 @@ static int omap24xxcam_mmap_buffers(struct file *file,
 	}
 
 	size = 0;
-	for (i = first; i <= last; i++) {
+	for (i = first; i <= last && i < VIDEO_MAX_FRAME; i++) {
 		struct videobuf_dmabuf *dma = videobuf_to_dma(vbq->bufs[i]);
 
 		for (j = 0; j < dma->sglen; j++) {
Acked-by on v1 1/1
#1 lore raw
Quoted 2 lines · Dan Carpenter

The previous loop goes until last = VIDEO_MAX_FRAME, so this could potentially go one past the end of the loop.

Hi Dan,

Thanks for the patch!

Quoted 7 lines
Signed-off-by Dan Carpenter <[email protected]>
drivers/media/video/omap24xxcam.c +0 -0
index 142c327..bedbee9 100644

drivers/media/video/omap24xxcam.c static int omap24xxcam_mmap_buffers(struct file *file, · line 1410

Quoted 8 lines
drivers/media/video/omap24xxcam.c +1 -1
@@ -1404,7 +1404,7 @@ static int omap24xxcam_mmap_buffers(struct file *file,
 	}
 
 	size = 0;
-	for (i = first; i <= last; i++) {
+	for (i = first; i <= last && i < VIDEO_MAX_FRAME; i++) {
 		struct videobuf_dmabuf *dma = videobuf_to_dma(vbq->bufs[i]);
 
 		for (j = 0; j < dma->sglen; j++) {

That function is quite an ugly piece of code... This patch fixes an obvious bug in it.

Acked-by Sakari Ailus <[email protected]>
Signature · 2 lines
Sakari Ailus
[email protected]