Guenter Roeck 4931578fbe media: uvcvideo: Prevent heap overflow when accessing mapped controls ...

commit 7e09f7d5c7 upstream.

The size of uvc_control_mapping is user controlled leading to a
potential heap overflow in the uvc driver. This adds a check to verify
the user provided size fits within the bounds of the defined buffer
size.

Originally-from: Richard Simmons <rssimmo@amazon.com>

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-09-27 11:00:16 +02:00

..

airspy

media: fix airspy usb probe error path

2016-08-10 11:49:29 +02:00

as102

…

au0828

au0828: Fix dev_state handling

2016-04-20 15:42:09 +09:00

b2c2

…

cpia2

…

cx231xx

cx231xx-cards: fix NULL-deref at probe

2017-05-25 14:30:14 +02:00

dvb-usb

dib0700: fix NULL-deref at probe

2017-05-25 14:30:14 +02:00

dvb-usb-v2

dvb-usb-v2: avoid use-after-free

2017-04-21 09:30:07 +02:00

em28xx

em28xx-i2c: rt_mutex_trylock() returns zero on failure

2016-10-07 15:23:44 +02:00

go7007

[media] media: videobuf2: Change queue_setup argument

2015-10-20 14:48:39 -02:00

gspca

gspca: konica: add missing endpoint sanity check

2017-05-25 14:30:14 +02:00

hackrf

[media] hackrf: move RF gain ctrl enable behind module parameter

2015-12-18 15:25:29 -02:00

hdpvr

…

msi2500

[media] media: videobuf2: Change queue_setup argument

2015-10-20 14:48:39 -02:00

pvrusb2

pvrusb2: reduce stack usage pvr2_eeprom_analyze()

2017-06-26 07:13:09 +02:00

pwc

pwc: Add USB id for Philips Spc880nc webcam

2016-04-12 09:08:42 -07:00

s2255

[media] media: videobuf2: Change queue_setup argument

2015-10-20 14:48:39 -02:00

siano

siano: make it work again with CONFIG_VMAP_STACK

2017-02-23 17:43:09 +01:00

stk1160

[media] media: videobuf2: Change queue_setup argument

2015-10-20 14:48:39 -02:00

stkwebcam

…

tm6000

[media] cx25821, cx88, tm6000: use SNDRV_DEFAULT_ENABLE_PNP

2015-10-01 08:42:52 -03:00

ttusb-budget

…

ttusb-dec

[media] dvb: get rid of enum dmx_success

2015-10-06 19:53:02 -03:00

usbtv

media: usbtv: prevent access to free'd resources

2016-08-20 18:09:18 +02:00

usbvision

usbvision: fix NULL-deref at probe

2017-05-25 14:30:12 +02:00

uvc

media: uvcvideo: Prevent heap overflow when accessing mapped controls

2017-09-27 11:00:16 +02:00

zr364xx

zr364xx: enforce minimum size when reading header

2017-05-25 14:30:14 +02:00

Kconfig

…

Makefile

…