media: vivid: potential integer overflow in vidioc_g_edid()

PATCH New Dan Carpenter 1 participant 1 message May 17, 2018

Subsystems (2)

Media (V4L/DVB) Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2018-05-17 08:58 UTC #0 lore raw

PATCH 1/1 media: vivid: potential integer overflow in vidioc_g_edid()

If we pick a very large "edid->blocks" value then the "edid->start_block
+ edid->blocks" addition could wrap around.

Fixes ef834f7836ec ("[media] vivid: add the video capture and output parts")

Signed-off-by Dan Carpenter <[email protected]>

drivers/media/platform/vivid/vivid-vid-common.c +1 -1

index e5914be0e12d..be531caa2cdf 100644
@@ -860,7 +860,7 @@ int vidioc_g_edid(struct file *file, void *_fh,
 		return -ENODATA;
 	if (edid->start_block >= dev->edid_blocks)
 		return -EINVAL;
-	if (edid->start_block + edid->blocks > dev->edid_blocks)
+	if (edid->blocks > dev->edid_blocks - edid->start_block)
 		edid->blocks = dev->edid_blocks - edid->start_block;
 	if (adap)
 		cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);