linux-kernel - [PATCH] Fix oops in VIDIOC_G

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <9879.1160673526@lwn.net>
Date:	Thu, 12 Oct 2006 11:18:46 -0600
From:	Jonathan Corbet <corbet-v4l@....net>
To:	video4linux-list@...hat.com
cc:	Mauro Carvalho Chehab <mchehab@...radead.org>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] Fix oops in VIDIOC_G_PARM

The call to v4l2_std_construct() in the VIDIOC_G_PARM handler treats
vfd->current_norm as if it were an index - but it's not.  The result is
an oops if the driver has no vidioc_g_parm() method defined.  Here's the
fix.

jon

Signed-off-by: Jonathan Corbet <corbet@....net>

--- /k/t/2.6.19-rc1/drivers/media/video/videodev.c	2006-10-05 16:05:24.000000000 -0600
+++ 19-jc/drivers/media/video/videodev.c	2006-10-12 11:11:07.000000000 -0600
@@ -1287,6 +1288,7 @@ static int __video_do_ioctl(struct inode
 			ret=vfd->vidioc_g_parm(file, fh, p);
 		} else {
 			struct v4l2_standard s;
+			int i;
 
 			if (!vfd->tvnormsize) {
 				printk (KERN_WARNING "%s: no TV norms defined!\n",
@@ -1297,8 +1299,14 @@ static int __video_do_ioctl(struct inode
 			if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
 				return -EINVAL;
 
-			v4l2_video_std_construct(&s, vfd->tvnorms[vfd->current_norm].id,
-						 vfd->tvnorms[vfd->current_norm].name);
+			for (i = 0; i < vfd->tvnormsize; i++)
+				if (vfd->tvnorms[i].id == vfd->current_norm)
+					break;
+			if (i >= vfd->tvnormsize)
+				return -EINVAL;
+
+			v4l2_video_std_construct(&s, vfd->current_norm,
+						 vfd->tvnorms[i].name);
 
 			memset(p,0,sizeof(*p));
 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/