* [PATCH] media: v4l2-compat-ioctl32: check for max size
@ 2020-10-19 11:54 Defang Bo
2020-10-30 10:32 ` Hans Verkuil
0 siblings, 1 reply; 2+ messages in thread
From: Defang Bo @ 2020-10-19 11:54 UTC (permalink / raw)
To: mchehab, hverkuil-cisco; +Cc: linux-media, linux-kernel, Defang Bo
Similar to commit<ea72fbf588ac>("media: v4l2-compat-ioctl32: prevent go past max size"} ,add max size check for count variable.
Signed-off-by: Defang Bo <bodefang@126.com>
---
drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index a99e82e..5041d60 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -207,7 +207,7 @@ static int put_v4l2_window32(struct v4l2_window __user *p64,
get_user(clipcount, &p64->clipcount) ||
put_user(clipcount, &p32->clipcount))
return -EFAULT;
- if (!clipcount)
+ if (!clipcount || count > (U32_MAX/sizeof(*uclips)))
return 0;
if (get_user(kclips, &p64->clips))
--
1.9.1
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] media: v4l2-compat-ioctl32: check for max size
2020-10-19 11:54 [PATCH] media: v4l2-compat-ioctl32: check for max size Defang Bo
@ 2020-10-30 10:32 ` Hans Verkuil
0 siblings, 0 replies; 2+ messages in thread
From: Hans Verkuil @ 2020-10-30 10:32 UTC (permalink / raw)
To: Defang Bo, mchehab; +Cc: linux-media, linux-kernel
On 19/10/2020 13:54, Defang Bo wrote:
> Similar to commit<ea72fbf588ac>("media: v4l2-compat-ioctl32: prevent go past max size"} ,add max size check for count variable.
>
> Signed-off-by: Defang Bo <bodefang@126.com>
> ---
> drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> index a99e82e..5041d60 100644
> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> @@ -207,7 +207,7 @@ static int put_v4l2_window32(struct v4l2_window __user *p64,
> get_user(clipcount, &p64->clipcount) ||
> put_user(clipcount, &p32->clipcount))
> return -EFAULT;
> - if (!clipcount)
> + if (!clipcount || count > (U32_MAX/sizeof(*uclips)))
Clearly you didn't compile this since count should have been clipcount.
And in any case, this is bogus since get_v4l2_window32() already checks that
clipcount doesn't exceed 2048.
Regards,
Hans
> return 0;
>
> if (get_user(kclips, &p64->clips))
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-10-30 10:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-19 11:54 [PATCH] media: v4l2-compat-ioctl32: check for max size Defang Bo
2020-10-30 10:32 ` Hans Verkuil
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®