Commit 1b8b10cc authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab

[media] v4l2-ioctl: add blocks check for VIDIOC_SUBDEV_G/S_EDID

The maximum size of an EDID is 32768 bytes, which is 32768 / 128 = 256 blocks.
Return -EINVAL if blocks > 256 to ensure that the memory allocation is sane.
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 8a18382c
......@@ -2212,6 +2212,10 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
struct v4l2_subdev_edid *edid = parg;
if (edid->blocks) {
if (edid->blocks > 256) {
ret = -EINVAL;
break;
}
*user_ptr = (void __user *)edid->edid;
*kernel_ptr = (void *)&edid->edid;
*array_size = edid->blocks * 128;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment