lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20131120095600.GA1475@mwanda> Date: Wed, 20 Nov 2013 12:56:00 +0300 From: Dan Carpenter <dan.carpenter@...cle.com> To: x90c <geinblues@...il.com> Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: Re: XADV-2013007 Linux Kernel bt8xx Video Driver IOCTL Heap Overflow On Mon, Nov 18, 2013 at 01:43:47PM +0900, x90c wrote: > [~linux/2.6.18/include/linux/videodev.h] > ---- > struct video_window > { > __u32 x,y; /* Position of window */ > __u32 width,height; /* Its size */ > __u32 chromakey; > __u32 flags; > struct video_clip __user *clips; /* Set only */ > int clipcount; > #define VIDEO_WINDOW_INTERLACE 1 > #define VIDEO_WINDOW_CHROMAKEY 16 /* Overlay by chromakey */ > #define VIDEO_CLIP_BITMAP -1 > /* bitmap is 1024x625, a '1' bit represents a clipped pixel */ > #define VIDEO_CLIPMAP_SIZE (128 * 625) > }; You are looking at the wrong struct. You should be looking at struct v4l2_window. clipount is unsigned in v4l2_window so the code is ok I think... I don't have the hardware so I can't test your PoC. regards, dan carpenter _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists