diff options
| author | Clark Williams <williams@redhat.com> | 2012-01-25 21:31:16 -0600 |
|---|---|---|
| committer | Clark Williams <williams@redhat.com> | 2012-01-25 21:31:16 -0600 |
| commit | 974f4b86951972b133b4ec5b36956b979dea08d0 (patch) | |
| tree | 090b441b1c96f708e8a033c7f88fa383dd1e7cba /drivers/media/video/uvc | |
| parent | 40a54e2e116950a27dbd0a46a7b1ff8e982de477 (diff) | |
| parent | 3499d6424f682a58761d827012567c552b053842 (diff) | |
Merge commit 'v3.2.2' into rt-3.2.2-rt10
Diffstat (limited to 'drivers/media/video/uvc')
| -rw-r--r-- | drivers/media/video/uvc/uvc_v4l2.c | 9 | ||||
| -rw-r--r-- | drivers/media/video/uvc/uvcvideo.h | 1 |
2 files changed, 10 insertions, 0 deletions
diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c index dadf11f704dc..cf7788f8a033 100644 --- a/drivers/media/video/uvc/uvc_v4l2.c +++ b/drivers/media/video/uvc/uvc_v4l2.c @@ -58,6 +58,15 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, break; case V4L2_CTRL_TYPE_MENU: + /* Prevent excessive memory consumption, as well as integer + * overflows. + */ + if (xmap->menu_count == 0 || + xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) { + ret = -EINVAL; + goto done; + } + size = xmap->menu_count * sizeof(*map->menu_info); map->menu_info = kmalloc(size, GFP_KERNEL); if (map->menu_info == NULL) { diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h index 4c1392ebcd4b..bc446ba5b6ce 100644 --- a/drivers/media/video/uvc/uvcvideo.h +++ b/drivers/media/video/uvc/uvcvideo.h @@ -113,6 +113,7 @@ /* Maximum allowed number of control mappings per device */ #define UVC_MAX_CONTROL_MAPPINGS 1024 +#define UVC_MAX_CONTROL_MENU_ENTRIES 32 /* Devices quirks */ #define UVC_QUIRK_STATUS_INTERVAL 0x00000001 |