Haogang Chen 806e23e95f [media] uvcvideo: Fix integer overflow in uvc_ioctl_ctrl_map() ... There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a large xmap->menu_count is passed from the userspace, the subsequent call to kmalloc() will allocate a buffer smaller than expected. map->menu_count and map->menu_info would later be used in a loop (e.g. in uvc_query_v4l2_ctrl), which leads to out-of-bound access. The patch checks the ioctl argument and returns -EINVAL for zero or too large values in xmap->menu_count. Signed-off-by: Haogang Chen <haogangchen@gmail.com> [laurent.pinchart@ideasonboard.com Prevent excessive memory consumption] Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>		2011-12-11 11:23:54 -02:00
..
common	[media] xc5000: Add support for 7MHz bandwidth for DVB-C/DVB-T	2011-12-09 08:01:01 -02:00
dvb	[media] it913x: multiple devices on system. Copy ite_config to priv area	2011-12-11 09:24:38 -02:00
radio	[media] radio: NUL terminate a user string	2011-11-25 15:46:59 -02:00
rc	[media] rc: Fix input deadlock and transmit error in redrat3 driver	2011-11-24 14:45:41 -02:00
video	[media] uvcvideo: Fix integer overflow in uvc_ioctl_ctrl_map()	2011-12-11 11:23:54 -02:00
Kconfig	[media] DVB: dvb-net, make the kconfig text helpful	2011-07-27 17:53:09 -03:00
Makefile	[media] media: Entities, pads and links	2011-03-22 04:53:10 -03:00
media-device.c	drivers/media: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required	2011-10-31 19:31:51 -04:00
media-devnode.c	[media] media: Fix media device minor registration	2011-06-01 13:24:23 -03:00
media-entity.c	[media] media: Properly handle link flags in link setup, link notify callback	2011-04-17 07:43:32 -03:00