Re: [patch -longterm v2] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()

2012-01-05 Thread Dan Carpenter
On Thu, Jan 05, 2012 at 08:43:58AM -0800, Greg KH wrote: > On Thu, Jan 05, 2012 at 09:28:22AM +0300, Dan Carpenter wrote: > > If p->count is too high the multiplication could overflow and > > array_size would be lower than expected. Mauro and Hans Verkuil > > suggested that we cap it at 1024. Tha

Re: [patch -longterm v2] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()

2012-01-05 Thread Greg KH
On Thu, Jan 05, 2012 at 09:28:22AM +0300, Dan Carpenter wrote: > If p->count is too high the multiplication could overflow and > array_size would be lower than expected. Mauro and Hans Verkuil > suggested that we cap it at 1024. That comes from the maximum > number of controls with lots of room f

[patch -longterm v2] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()

2012-01-04 Thread Dan Carpenter
If p->count is too high the multiplication could overflow and array_size would be lower than expected. Mauro and Hans Verkuil suggested that we cap it at 1024. That comes from the maximum number of controls with lots of room for expantion. $ grep V4L2_CID include/linux/videodev2.h | wc -l 211 S