Skip to main content

Browse the archive

https://github.com/torvalds/linux
05 April 2024, 19:05:47 UTC
Revision fe6c700ff34e68e1eb7991e9c5d18986d0005ac1 authored by Ralph Loader on 23 September 2008, 00:06:48 UTC, committed by Mauro Carvalho Chehab on 05 October 2008, 02:04:32 UTC 
V4L/DVB (9053): fix buffer overflow in uvc-video
 
There is a buffer overflow in drivers/media/video/uvc/uvc_ctrl.c:

INFO: 0xf2c5ce08-0xf2c5ce0b. First byte 0xa1 instead of 0xcc
INFO: Allocated in uvc_query_v4l2_ctrl+0x3c/0x239 [uvcvideo] age=13 cpu=1 pid=4975
...

A fixed size 8-byte buffer is allocated, and a variable size field is read
into it; there is no particular bound on the size of the field (it is
dependent on hardware and configuration) and it can overflow [also
verified by inserting printk's.]

The patch attempts to size the buffer to the correctly.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
1 parent bda1cda
History
Tip revision: fe6c700ff34e68e1eb7991e9c5d18986d0005ac1 authored by Ralph Loader on 23 September 2008, 00:06:48 UTC
V4L/DVB (9053): fix buffer overflow in uvc-video
Tip revision: fe6c700
File Mode Size
Kconfig -rw-r--r-- 4.8 KB
Makefile -rw-r--r-- 416 bytes
dcdbas.c -rw-r--r-- 15.6 KB
dcdbas.h -rw-r--r-- 2.7 KB
dell_rbu.c -rw-r--r-- 18.9 KB
dmi-id.c -rw-r--r-- 6.4 KB
dmi_scan.c -rw-r--r-- 12.7 KB
edd.c -rw-r--r-- 19.8 KB
efivars.c -rw-r--r-- 19.6 KB
iscsi_ibft.c -rw-r--r-- 23.1 KB
iscsi_ibft_find.c -rw-r--r-- 2.2 KB
memmap.c -rw-r--r-- 6.8 KB
pcdp.c -rw-r--r-- 3.3 KB
pcdp.h -rw-r--r-- 2.7 KB
back to top