[media] v4l2-ioctl: add blocks check for VIDIOC_SUBDEV_G/S_EDID
The maximum size of an EDID is 32768 bytes, which is 32768 / 128 = 256 blocks. Return -EINVAL if blocks > 256 to ensure that the memory allocation is sane. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
parent
8a18382c31
commit
1b8b10cc7e
|
@ -2212,6 +2212,10 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
|
|||
struct v4l2_subdev_edid *edid = parg;
|
||||
|
||||
if (edid->blocks) {
|
||||
if (edid->blocks > 256) {
|
||||
ret = -EINVAL;
|
||||
break;
|
||||
}
|
||||
*user_ptr = (void __user *)edid->edid;
|
||||
*kernel_ptr = (void *)&edid->edid;
|
||||
*array_size = edid->blocks * 128;
|
||||
|
|
Loading…
Reference in New Issue