leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[media] v4l: Check pad arguments for [gs]_frame_interval

Browse Source 
VIDIOC_SUBDEV_[GS]_FRAME_INTERVAL IOCTLs argument structs contain the pad
field but the validity check was missing. There should be no implications
security-wise from this since no driver currently uses the pad field in the
struct.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
This commit is contained in:
Sakari Ailus 2013-04-22 10:24:51 -03:00 committed by Mauro Carvalho Chehab
parent 6296cba83b
commit 743e18377c
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/media/v4l2-core/v4l2-subdev.c
View File

@ -305,11 +305,23 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg)
fse); fse);
} }
case VIDIOC_SUBDEV_G_FRAME_INTERVAL: case VIDIOC_SUBDEV_G_FRAME_INTERVAL: {
return v4l2_subdev_call(sd, video, g_frame_interval, arg); struct v4l2_subdev_frame_interval *fi = arg;
if (fi->pad >= sd->entity.num_pads)
return -EINVAL;
return v4l2_subdev_call(sd, video, g_frame_interval, arg);
}
case VIDIOC_SUBDEV_S_FRAME_INTERVAL: {
struct v4l2_subdev_frame_interval *fi = arg;
if (fi->pad >= sd->entity.num_pads)
return -EINVAL;
case VIDIOC_SUBDEV_S_FRAME_INTERVAL:
return v4l2_subdev_call(sd, video, s_frame_interval, arg); return v4l2_subdev_call(sd, video, s_frame_interval, arg);
}
case VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL: { case VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL: {
struct v4l2_subdev_frame_interval_enum *fie = arg; struct v4l2_subdev_frame_interval_enum *fie = arg;