v4l2-subdev: add support for the new edid ioctls

media Dan Carpenter 2 participants 2 messages Sep 26, 2012 Media (V4L/DVB)

Share & tools

Dan Carpenter

author

2012-09-26 08:01 UTC #0 lore raw

Hi Hans,

The patch ed45ce2cc0b3: "[media] v4l2-subdev: add support for the new edid ioctls" from Aug 10, 2012, needs an overflow check the same as the other cases in that switch statement.

drivers/media/v4l2-core/v4l2-ioctl.c

2200 case VIDIOC_SUBDEV_G_EDID:
2201 case VIDIOC_SUBDEV_S_EDID: {
2202 struct v4l2_subdev_edid *edid = parg;
2203
2204 if (edid->blocks) {

  2205                          *user_ptr = (void __user *)edid->edid;
  2206                          *kernel_ptr = (void *)&edid->edid;
  2207                          *array_size = edid->blocks * 128;
                                              ^^^^^^^^^^^^^^^^^^

This can overflow.

  2208                          ret = 1;
  2209                  }
  2210                  break;
  2211          }

regards,
dan carpenter

Hans Verkuil

2012-09-26 08:14 UTC #1 lore raw

Quoted 17 lines · On Wed 26 September 2012 10:01:06 Dan Carpenter wrote:

Hi Hans,
The patch ed45ce2cc0b3: "[media] v4l2-subdev: add support for the new edid ioctls" from Aug 10, 2012, needs an overflow check the same as the other cases in that switch statement.
drivers/media/v4l2-core/v4l2-ioctl.c
2200 case VIDIOC_SUBDEV_G_EDID:
2201 case VIDIOC_SUBDEV_S_EDID: {
2202 struct v4l2_subdev_edid *edid = parg;
2203
2204 if (edid->blocks) {
  2205                          *user_ptr = (void __user *)edid->edid;
  2206                          *kernel_ptr = (void *)&edid->edid;
  2207                          *array_size = edid->blocks * 128;
                                              ^^^^^^^^^^^^^^^^^^

Quoted 6 lines

This can overflow.

  2208                          ret = 1;
  2209                  }
  2210                  break;
  2211          }

True. Thanks for reporting this! I'll make a fix for it.

Regards,

Hans