]>
Commit | Line | Data |
---|---|---|
5e3c2993 GKH |
1 | From 806e23e95f94a27ee445022d724060b9b45cb64a Mon Sep 17 00:00:00 2001 |
2 | From: Haogang Chen <haogangchen@gmail.com> | |
3 | Date: Tue, 29 Nov 2011 18:32:25 -0300 | |
4 | Subject: [media] uvcvideo: Fix integer overflow in uvc_ioctl_ctrl_map() | |
5 | ||
6 | From: Haogang Chen <haogangchen@gmail.com> | |
7 | ||
8 | commit 806e23e95f94a27ee445022d724060b9b45cb64a upstream. | |
9 | ||
10 | There is a potential integer overflow in uvc_ioctl_ctrl_map(). When a | |
11 | large xmap->menu_count is passed from the userspace, the subsequent call | |
12 | to kmalloc() will allocate a buffer smaller than expected. | |
13 | map->menu_count and map->menu_info would later be used in a loop (e.g. | |
14 | in uvc_query_v4l2_ctrl), which leads to out-of-bound access. | |
15 | ||
16 | The patch checks the ioctl argument and returns -EINVAL for zero or too | |
17 | large values in xmap->menu_count. | |
18 | ||
19 | Signed-off-by: Haogang Chen <haogangchen@gmail.com> | |
20 | [laurent.pinchart@ideasonboard.com Prevent excessive memory consumption] | |
21 | Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> | |
22 | Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> | |
23 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
24 | ||
25 | --- | |
26 | drivers/media/video/uvc/uvc_v4l2.c | 9 +++++++++ | |
27 | drivers/media/video/uvc/uvcvideo.h | 1 + | |
28 | 2 files changed, 10 insertions(+) | |
29 | ||
30 | --- a/drivers/media/video/uvc/uvc_v4l2.c | |
31 | +++ b/drivers/media/video/uvc/uvc_v4l2.c | |
32 | @@ -65,6 +65,15 @@ static int uvc_ioctl_ctrl_map(struct uvc | |
33 | goto done; | |
34 | } | |
35 | ||
36 | + /* Prevent excessive memory consumption, as well as integer | |
37 | + * overflows. | |
38 | + */ | |
39 | + if (xmap->menu_count == 0 || | |
40 | + xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) { | |
41 | + ret = -EINVAL; | |
42 | + goto done; | |
43 | + } | |
44 | + | |
45 | size = xmap->menu_count * sizeof(*map->menu_info); | |
46 | map->menu_info = kmalloc(size, GFP_KERNEL); | |
47 | if (map->menu_info == NULL) { | |
48 | --- a/drivers/media/video/uvc/uvcvideo.h | |
49 | +++ b/drivers/media/video/uvc/uvcvideo.h | |
50 | @@ -200,6 +200,7 @@ struct uvc_xu_control { | |
51 | ||
52 | /* Maximum allowed number of control mappings per device */ | |
53 | #define UVC_MAX_CONTROL_MAPPINGS 1024 | |
54 | +#define UVC_MAX_CONTROL_MENU_ENTRIES 32 | |
55 | ||
56 | /* Devices quirks */ | |
57 | #define UVC_QUIRK_STATUS_INTERVAL 0x00000001 |