Commit 9086c7b9 authored by Márton Németh's avatar Márton Németh Committed by Mauro Carvalho Chehab

V4L/DVB (11573): uvcvideo: Prevent invormation loss with removing implicit casting

The uvcvideo driver supports only one input, which is input 0. For all
other input index the return value shall be EINVAL. This patch fixes the
problem when the value 0x80000000 was incorrectly casted and treated as
a zero value.

The patch was tested with v4l-test 0.10 [2] with CNF7129 webcam found on
EeePC 901.

References:
[1] V4L2 API specification, revision 0.24
    http://v4l2spec.bytesex.org/spec/r11217.htm

[2] v4l-test: Test environment for Video For Linux Two API
    http://v4l-test.sourceforge.net/

[Modified by Laurent Pinchart]

Invalid input value (u32)-1 would be accepted due to integer overflow. Make
sure the driver rejects it and returns -EINVAL.
Signed-off-by: default avatarMárton Németh <nm127@freemail.hu>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 513846ec
...@@ -648,7 +648,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg) ...@@ -648,7 +648,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
case VIDIOC_S_INPUT: case VIDIOC_S_INPUT:
{ {
u8 input = *(u32 *)arg + 1; u32 input = *(u32 *)arg + 1;
if ((ret = uvc_acquire_privileges(handle)) < 0) if ((ret = uvc_acquire_privileges(handle)) < 0)
return ret; return ret;
...@@ -660,7 +660,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg) ...@@ -660,7 +660,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
break; break;
} }
if (input > video->selector->selector.bNrInPins) if (input == 0 || input > video->selector->selector.bNrInPins)
return -EINVAL; return -EINVAL;
return uvc_query_ctrl(video->dev, SET_CUR, video->selector->id, return uvc_query_ctrl(video->dev, SET_CUR, video->selector->id,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment