Re: gspca_zc3xx oops - 2.6.27-rc1 - Jean-Francois Moine

From: Jean-Francois Moine <moinejf@free.fr>
To: Rabin Vincent <rabin@rab.in>
Cc: video4linux-list@redhat.com, Parag Warudkar <parag.warudkar@gmail.com>
Subject: Re: gspca_zc3xx oops - 2.6.27-rc1
Date: Sun, 03 Aug 2008 10:04:28 +0200	[thread overview]
Message-ID: <1217750668.1714.5.camel@localhost> (raw)
In-Reply-To: <20080803073705.GA2754@debian>

On Sun, 2008-08-03 at 13:07 +0530, Rabin Vincent wrote:
	[snip]
> Now sd->gamma shouldn't be zero because in sd_ctrls, the minimum value for it
> is set to 1.  This range should be checked by vidioc_s_ctrl in gspca.c, and we
> have this there:
> 
>                if (ctrl->value < ctrls->qctrl.minimum
>                    && ctrl->value > ctrls->qctrl.maximum)
>                         return -ERANGE;
> 
> There's a typo in this check, so userspace is able to set gamma to zero, and
> the crash happens when streaming is started.

Thank you! I did see the gamma was null, but I was searching for some
array overflow...

> Could you please try the patch below?
> 
> >From 6827a2973d512479c8cf61d4a7ae1b6c4099b65b Mon Sep 17 00:00:00 2001
> From: Rabin Vincent <rabin@rab.in>
> Date: Sun, 3 Aug 2008 12:00:04 +0530
> Subject: [PATCH] gspca: Fix ioctl range checking
	[snip]

In which list did you post?

Cheers.

-- 
Ken ar c'hentañ |             ** Breizh ha Linux atav! **
Jef             |               http://moinejf.free.fr/

--
video4linux-list mailing list
Unsubscribe mailto:video4linux-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/video4linux-list