linux-stable/drivers/media
Sakari Ailus a56bc17159 [media] v4l: compat: Prevent allocating excessive amounts of memory
get_v4l2_ext_controls32() is used to convert the 32-bit compat struct into
native 64-bit representation. The function multiplies the array length by
the entry length before validating size. Perform the size validation
first.

Also use unsigned values for size computation.

Make similar changes to get_v4l2_buffer32() for multi-plane buffers.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-11-22 10:31:23 -02:00
..
cec [media] cec: ignore messages that we initiated 2016-11-22 05:43:07 -02:00
common [media] dvb: make DVB frontend *_ops instances "const" 2016-11-18 15:00:22 -02:00
dvb-core Revert "[media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations" 2016-11-18 20:44:33 -02:00
dvb-frontends Revert "[media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations" 2016-11-18 20:44:33 -02:00
firewire [media] firewire: don't break long lines 2016-10-21 10:06:00 -02:00
i2c [media] tvp5150: get rid of KERN_CONT 2016-11-18 10:11:09 -02:00
mmc
pci [media] zoran: fix spelling mistake in dprintk message 2016-11-22 05:41:56 -02:00
platform [media] ti-vpe: get rid of some smatch warnings 2016-11-22 09:08:36 -02:00
radio [media] wl128x: use KERNEL_CONT where needed 2016-11-18 09:37:24 -02:00
rc [media] serial_ir: fix reference to 8250 serial code 2016-11-22 06:17:44 -02:00
spi [media] gs1662: drop kfree for memory allocated with devm_kzalloc 2016-10-24 17:59:08 -02:00
tuners Revert "[media] dvb_frontend: merge duplicate dvb_tuner_ops.release implementations" 2016-11-18 20:44:33 -02:00
usb [media] dvb-usb: remove another redundant #include <linux/kconfig.h> 2016-11-21 14:30:01 -02:00
v4l2-core [media] v4l: compat: Prevent allocating excessive amounts of memory 2016-11-22 10:31:23 -02:00
cec-edid.c
Kconfig [media] Kconfig: fix breakages when DVB_CORE is not selected 2016-11-18 17:59:17 -02:00
Makefile [media] cec: move the CEC framework out of staging and to media 2016-11-16 15:40:20 -02:00
media-device.c [media] drivers/media/media-device: fix double free bug in _unregister() 2016-11-18 15:29:27 -02:00
media-devnode.c
media-entity.c [media] media-entity: clear media_gobj.mdev in _destroy() 2016-11-18 15:19:16 -02:00