linux/drivers/media
Dan Carpenter dd6e2a981b media: omap_vout: potential buffer overflow in vidioc_dqbuf()
The "b->index" is a u32 the comes from the user in the ioctl.  It hasn't
been checked.  We aren't supposed to use it but we're instead supposed
to use the value that gets written to it when we call videobuf_dqbuf().

The videobuf_dqbuf() first memsets it to zero and then re-initializes it
inside the videobuf_status() function.  It's this final value which we
want.

Hans Verkuil pointed out that we need to check the return from
videobuf_dqbuf().  I ended up doing a little cleanup related to that as
well.

Fixes: 72915e851d ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-05-08 13:58:49 -04:00
..
cec media: cec-notifier: add cec_notifier_parse_hdmi_phandle helper 2019-04-22 13:09:59 -04:00
common media: vb2: add waiting_in_dqbuf flag 2019-04-22 11:50:07 -04:00
dvb-core media: dvbdev: remove double-unlock 2019-03-28 14:36:14 -04:00
dvb-frontends media: ts2020: Variable "utmp" in function ts2020_set_tuner_rf() could be uninitialized 2019-04-22 13:05:54 -04:00
firewire media: firewire: Fix app_info parameter type in avc_ca{,_app}_info 2018-12-05 05:34:33 -05:00
i2c media: st-mipid02: MIPID02 CSI-2 to PARALLEL bridge driver 2019-04-22 11:39:20 -04:00
mmc media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
pci media: bt8xx: avoid a needless u8 to char conversion 2019-03-29 10:29:40 -04:00
platform media: omap_vout: potential buffer overflow in vidioc_dqbuf() 2019-05-08 13:58:49 -04:00
radio media: replace strncpy() by strscpy() 2019-03-29 10:26:13 -04:00
rc media: rc: xbox_remote: add protocol and set timeout 2019-04-22 13:02:53 -04:00
spi media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
tuners media: tuners: fix several typos 2019-03-01 09:40:29 -05:00
usb media: pvrusb2: Prevent a buffer overflow 2019-04-22 11:45:08 -04:00
v4l2-core media: v4l2-common: add bayer formats in v4l2_format_info 2019-04-22 10:33:45 -04:00
Kconfig media: Kconfig files: use the right help coding style 2019-03-20 06:47:51 -04:00
Makefile media: Media Device Allocator API 2019-04-22 11:18:26 -04:00
media-dev-allocator.c media: Media Device Allocator API 2019-04-22 11:18:26 -04:00
media-device.c media: Add a Kconfig option for the Request API 2018-12-05 13:07:43 -05:00
media-devnode.c media: Clear devnode->media_dev holding media_devnode_lock 2019-04-22 11:24:33 -04:00
media-entity.c media: replace WARN_ON in __media_pipeline_start() 2019-03-19 14:01:08 -04:00
media-request.c media: media requests: return EBADR instead of EACCES 2019-03-25 13:26:10 -04:00