diff options
| author | Mauro Carvalho Chehab <mchehab@infradead.org> | 2008-07-04 00:34:59 +0000 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@infradead.org> | 2008-07-04 00:34:59 +0000 |
| commit | e012707cc3ef84b0975d95bf66576a6d3180b1ba (patch) | |
| tree | 7da5b156e2355fadd64b24f33ef8d9aa49ff48bb /linux/drivers/media/video/uvc | |
| parent | 876b68cd089ef4531e4d3ce90c3c3d3ddd4e1e84 (diff) | |
| download | mediapointer-dvb-s2-e012707cc3ef84b0975d95bf66576a6d3180b1ba.tar.gz mediapointer-dvb-s2-e012707cc3ef84b0975d95bf66576a6d3180b1ba.tar.bz2 | |
uvcvideo: Fix a buffer overflow in format descriptor parsing
From: Laurent Pinchart <laurent.pinchart@skynet.be>
Thanks to Oliver Neukum for catching and reporting this bug.
Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Diffstat (limited to 'linux/drivers/media/video/uvc')
| -rw-r--r-- | linux/drivers/media/video/uvc/uvc_driver.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/linux/drivers/media/video/uvc/uvc_driver.c b/linux/drivers/media/video/uvc/uvc_driver.c index e7b469ca5..31a0e706a 100644 --- a/linux/drivers/media/video/uvc/uvc_driver.c +++ b/linux/drivers/media/video/uvc/uvc_driver.c @@ -298,7 +298,8 @@ static int uvc_parse_format(struct uvc_device *dev, switch (buffer[2]) { case VS_FORMAT_UNCOMPRESSED: case VS_FORMAT_FRAME_BASED: - if (buflen < 27) { + n = buffer[2] == VS_FORMAT_UNCOMPRESSED ? 27 : 28; + if (buflen < n) { uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming" "interface %d FORMAT error\n", dev->udev->devnum, |