This is an automatic generated email to let you know that the following patch were queued at the http://git.linuxtv.org/media_tree.git tree:
Subject: [media] v4l2-ioctl: add blocks check for VIDIOC_SUBDEV_G/S_EDID Author: Hans Verkuil <[email protected]> Date: Tue Oct 2 02:47:58 2012 -0300 The maximum size of an EDID is 32768 bytes, which is 32768 / 128 = 256 blocks. Return -EINVAL if blocks > 256 to ensure that the memory allocation is sane. Signed-off-by: Hans Verkuil <[email protected]> Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]> drivers/media/v4l2-core/v4l2-ioctl.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) --- http://git.linuxtv.org/media_tree.git?a=commitdiff;h=1b8b10cc7e6bd9bf017c58e32b1e7f632e23850d diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index 16205d9..11874c1 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -2212,6 +2212,10 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size, struct v4l2_subdev_edid *edid = parg; if (edid->blocks) { + if (edid->blocks > 256) { + ret = -EINVAL; + break; + } *user_ptr = (void __user *)edid->edid; *kernel_ptr = (void *)&edid->edid; *array_size = edid->blocks * 128; _______________________________________________ linuxtv-commits mailing list [email protected] http://www.linuxtv.org/cgi-bin/mailman/listinfo/linuxtv-commits
