Dan Carpenter 065449fd56 V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy() ...

commit 6c06108be5 upstream.

If ctrls->count is too high the multiplication could overflow and
array_size would be lower than expected.  Mauro and Hans Verkuil
suggested that we cap it at 1024.  That comes from the maximum
number of controls with lots of room for expantion.

$ grep V4L2_CID include/linux/videodev2.h | wc -l
211

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2012-01-25 17:24:46 -08:00

..

acpi

Merge branches 'd3cold', 'bugzilla-37412' and 'bugzilla-38152' into release

2011-07-14 00:16:38 -04:00

asm-generic

Merge branches 'gpio/merge' and 'spi/merge' of git://git.secretlab.ca/git/linux-2.6

2011-06-17 10:36:32 -07:00

crypto

crypto: padlock - Move padlock.h into include/crypto

2011-01-07 14:52:00 +11:00

drm

drm/radeon/kms: add some new pci ids

2011-12-21 12:57:45 -08:00

keys

libceph: Create a new key type "ceph".

2011-03-29 12:11:24 -07:00

linux

V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()

2012-01-25 17:24:46 -08:00

math-emu

…

media

[media] tuner-core/v4l2-subdev: document that the type field has to be filled in

2011-07-07 15:04:23 -03:00

mtd

UBI: fix minor stylistic issues

2011-04-14 11:34:41 +03:00

net

sctp: fix incorrect overflow check on autoclose

2012-01-06 14:14:08 -08:00

pcmcia

pcmcia: Make declaration and uses of struct pcmcia_device_id const

2011-05-06 07:46:15 +02:00

rdma

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

2011-05-26 12:13:57 -07:00

rxrpc

Fix common misspellings

2011-03-31 11:26:23 -03:00

scsi

[SCSI] libsas: Add option for SATA soft reset

2011-05-26 22:49:33 -05:00

sound

ALSA: sb16 - Fix build errors on MIPS and others with 13bit ioctl size

2011-06-30 15:33:57 +02:00

target

[SCSI] target: Convert REPORT_LUNs to use int_to_scsilun

2011-05-24 13:02:42 -04:00

trace

Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

2011-06-21 10:22:35 -07:00

video

Merge branches 'common/fbdev' and 'common/fbdev-meram' of master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6

2011-05-24 15:49:57 +09:00

xen

xen/xenbus: Reject replies with payload > XENSTORE_PAYLOAD_MAX.

2012-01-25 17:24:41 -08:00

Kbuild

…