diff options
| author | Xi Wang <[email protected]> | 2012-04-09 17:15:45 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <[email protected]> | 2012-04-19 09:11:25 -0300 |
| commit | 32898a145404acbebe3256709e012c2830a2043b (patch) | |
| tree | fb62bbd35c0936e59daf533624cf7372c49d847a /drivers/mtd/lpddr/lpddr_cmds.c | |
| parent | 3fc82fa001cac8f22e7493a02c795f2bb33cafac (diff) | |
[media] zoran: fix integer overflow in setup_window()
`clipcount' is from userspace and thus needs validation. Otherwise,
a large `clipcount' could overflow the vmalloc() size, leading to
out-of-bounds access.
| setup_window()
| zoran_s_fmt_vid_overlay()
| __video_do_ioctl()
| video_ioctl2()
Use 2048 as the maximum `clipcount'. Also change the corresponding
parameter type to `unsigned int'.
Signed-off-by: Xi Wang <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Diffstat (limited to 'drivers/mtd/lpddr/lpddr_cmds.c')
0 files changed, 0 insertions, 0 deletions