From d4b7ca589b79b68daaa259887670edeef1ca37d4 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 15 Apr 2009 14:01:58 +0200 Subject: uvcvideo: Prevent invormation loss with removing implicit casting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Márton Németh The uvcvideo driver supports only one input, which is input 0. For all other input index the return value shall be EINVAL. This patch fixes the problem when the value 0x80000000 was incorrectly casted and treated as a zero value. The patch was tested with v4l-test 0.10 [2] with CNF7129 webcam found on EeePC 901. References: [1] V4L2 API specification, revision 0.24 http://v4l2spec.bytesex.org/spec/r11217.htm [2] v4l-test: Test environment for Video For Linux Two API http://v4l-test.sourceforge.net/ [Modified by Laurent Pinchart] Invalid input value (u32)-1 would be accepted due to integer overflow. Make sure the driver rejects it and returns -EINVAL. Priority: normal Signed-off-by: Márton Németh Signed-off-by: Andrew Morton Signed-off-by: Laurent Pinchart --- linux/drivers/media/video/uvc/uvc_v4l2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'linux/drivers/media/video') diff --git a/linux/drivers/media/video/uvc/uvc_v4l2.c b/linux/drivers/media/video/uvc/uvc_v4l2.c index aa7949d95..e03419afe 100644 --- a/linux/drivers/media/video/uvc/uvc_v4l2.c +++ b/linux/drivers/media/video/uvc/uvc_v4l2.c @@ -654,7 +654,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg) case VIDIOC_S_INPUT: { - u8 input = *(u32 *)arg + 1; + u32 input = *(u32 *)arg + 1; if ((ret = uvc_acquire_privileges(handle)) < 0) return ret; @@ -666,7 +666,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg) break; } - if (input > video->selector->selector.bNrInPins) + if (input == 0 || input > video->selector->selector.bNrInPins) return -EINVAL; return uvc_query_ctrl(video->dev, SET_CUR, video->selector->id, -- cgit v1.2.3