V4L/DVB (8207): uvcvideo: Fix a buffer overflow in format descriptor parsing
authorLaurent Pinchart <laurent.pinchart@skynet.be>
Fri, 4 Jul 2008 03:34:59 +0000 (00:34 -0300)
committerMauro Carvalho Chehab <mchehab@infradead.org>
Sun, 20 Jul 2008 10:17:34 +0000 (07:17 -0300)
Thanks to Oliver Neukum for catching and reporting this bug.

Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
drivers/media/video/uvc/uvc_driver.c

index 60ced589f89815d84de454fffb2e1cd6916bf4bd..86bb16d001730a61b51776ab48130ae210d16036 100644 (file)
@@ -298,7 +298,8 @@ static int uvc_parse_format(struct uvc_device *dev,
        switch (buffer[2]) {
        case VS_FORMAT_UNCOMPRESSED:
        case VS_FORMAT_FRAME_BASED:
-               if (buflen < 27) {
+               n = buffer[2] == VS_FORMAT_UNCOMPRESSED ? 27 : 28;
+               if (buflen < n) {
                        uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming"
                               "interface %d FORMAT error\n",
                               dev->udev->devnum,