diff options
| author | Xi Wang <xi.wang@gmail.com> | 2012-04-09 22:15:45 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2012-04-19 14:11:25 +0200 |
| commit | 32898a145404acbebe3256709e012c2830a2043b (patch) | |
| tree | fb62bbd35c0936e59daf533624cf7372c49d847a /Documentation/fb/intelfb.txt | |
| parent | [media] s2255drv: Remove redundant NULL test before release_firmware() (diff) | |
| download | linux-32898a145404acbebe3256709e012c2830a2043b.tar.xz linux-32898a145404acbebe3256709e012c2830a2043b.zip | |
[media] zoran: fix integer overflow in setup_window()
`clipcount' is from userspace and thus needs validation. Otherwise,
a large `clipcount' could overflow the vmalloc() size, leading to
out-of-bounds access.
| setup_window()
| zoran_s_fmt_vid_overlay()
| __video_do_ioctl()
| video_ioctl2()
Use 2048 as the maximum `clipcount'. Also change the corresponding
parameter type to `unsigned int'.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'Documentation/fb/intelfb.txt')
0 files changed, 0 insertions, 0 deletions