diff options
| author | Laurent Pinchart <laurent.pinchart@skynet.be> | 2008-07-21 21:53:45 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2008-08-01 12:43:08 -0700 |
| commit | 3b778ebff0050c61a25279f239c20f77b1b1f3fa (patch) | |
| tree | f72e2296f30d7daa0f898ec4d10d336816e078a2 | |
| parent | a5cfcdb0c23b817d430d2778332927d8686931d2 (diff) | |
V4L: uvcvideo: Fix a buffer overflow in format descriptor parsing
(cherry picked from commit 233548a2fd934a0220db8b1521c0bc88c82e5e53)
V4L: uvcvideo: Fix a buffer overflow in format descriptor parsing
Thanks to Oliver Neukum for catching and reporting this bug.
Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/media/video/uvc/uvc_driver.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c index 60ced589f898..86bb16d00173 100644 --- a/drivers/media/video/uvc/uvc_driver.c +++ b/drivers/media/video/uvc/uvc_driver.c @@ -298,7 +298,8 @@ static int uvc_parse_format(struct uvc_device *dev, switch (buffer[2]) { case VS_FORMAT_UNCOMPRESSED: case VS_FORMAT_FRAME_BASED: - if (buflen < 27) { + n = buffer[2] == VS_FORMAT_UNCOMPRESSED ? 27 : 28; + if (buflen < n) { uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming" "interface %d FORMAT error\n", dev->udev->devnum, |