The patch number 8207 was added via Mauro Carvalho Chehab <[EMAIL PROTECTED]>
to http://linuxtv.org/hg/v4l-dvb master development tree.
Kernel patches in this development tree may be modified to be backward
compatible with older kernels. Compatibility modifications will be
removed before inclusion into the mainstream Kernel
If anyone has any objections, please let us know by sending a message to:
[EMAIL PROTECTED]
------
From: Laurent Pinchart <[EMAIL PROTECTED]>
uvcvideo: Fix a buffer overflow in format descriptor parsing
Thanks to Oliver Neukum for catching and reporting this bug.
Signed-off-by: Laurent Pinchart <[EMAIL PROTECTED]>
Signed-off-by: Mauro Carvalho Chehab <[EMAIL PROTECTED]>
---
linux/drivers/media/video/uvc/uvc_driver.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff -r e937406381c0 -r 59224fdb6877 linux/drivers/media/video/uvc/uvc_driver.c
--- a/linux/drivers/media/video/uvc/uvc_driver.c Mon Jul 07 12:00:02
2008 -0300
+++ b/linux/drivers/media/video/uvc/uvc_driver.c Fri Jul 04 00:34:59
2008 +0000
@@ -298,7 +298,8 @@ static int uvc_parse_format(struct uvc_d
switch (buffer[2]) {
case VS_FORMAT_UNCOMPRESSED:
case VS_FORMAT_FRAME_BASED:
- if (buflen < 27) {
+ n = buffer[2] == VS_FORMAT_UNCOMPRESSED ? 27 : 28;
+ if (buflen < n) {
uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming"
"interface %d FORMAT error\n",
dev->udev->devnum,
---
Patch is available at:
http://linuxtv.org/hg/v4l-dvb/rev/59224fdb687772295f35595548fe3fa2960d4e02
_______________________________________________
linuxtv-commits mailing list
linuxtv-commits@linuxtv.org
http://www.linuxtv.org/cgi-bin/mailman/listinfo/linuxtv-commits
