aboutsummaryrefslogtreecommitdiff
path: root/drivers/media/video/v4l2-ctrls.c
diff options
context:
space:
mode:
authorXi Wang2012-04-06 09:32:37 -0300
committerMauro Carvalho Chehab2012-04-18 11:09:38 -0300
commit0a3475eb618321013dab9ac744201ed09e8061f9 (patch)
treef7a35e0a964fa25b09eeb9251276005a74d7c632 /drivers/media/video/v4l2-ctrls.c
parent5f0049bd69b96537dc7c02755c169fb4ccca3ddf (diff)
[media] v4l2-ctrls: fix integer overflow in try_set_ext_ctrls()
A large cs->count from userspace may overflow the allocation size, leading to memory corruption. try_set_ext_ctrls() can be reached from subdev_do_ioctl() or __video_do_ioctl(). Use kmalloc_array() to avoid the overflow. Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video/v4l2-ctrls.c')
-rw-r--r--drivers/media/video/v4l2-ctrls.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/media/video/v4l2-ctrls.c b/drivers/media/video/v4l2-ctrls.c
index bf62b105b49d..1a71aa5fd458 100644
--- a/drivers/media/video/v4l2-ctrls.c
+++ b/drivers/media/video/v4l2-ctrls.c
@@ -2259,7 +2259,8 @@ static int try_set_ext_ctrls(struct v4l2_fh *fh, struct v4l2_ctrl_handler *hdl,
return class_check(hdl, cs->ctrl_class);
if (cs->count > ARRAY_SIZE(helper)) {
- helpers = kmalloc(sizeof(helper[0]) * cs->count, GFP_KERNEL);
+ helpers = kmalloc_array(cs->count, sizeof(helper[0]),
+ GFP_KERNEL);
if (!helpers)
return -ENOMEM;
}