* [patch] omap24xxcam: potential buffer overflow
@ 2010-03-10 10:57 Dan Carpenter
2010-03-10 21:47 ` Sakari Ailus
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2010-03-10 10:57 UTC (permalink / raw)
To: linux-media
Cc: Mauro Carvalho Chehab, Laurent Pinchart, Greg Kroah-Hartman,
Trent Piepho, Hans Verkuil, kernel-janitors, sakari.ailus
The previous loop goes until last == VIDEO_MAX_FRAME, so this could
potentially go one past the end of the loop.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c
index 142c327..bedbee9 100644
--- a/drivers/media/video/omap24xxcam.c
+++ b/drivers/media/video/omap24xxcam.c
@@ -1404,7 +1404,7 @@ static int omap24xxcam_mmap_buffers(struct file *file,
}
size = 0;
- for (i = first; i <= last; i++) {
+ for (i = first; i <= last && i < VIDEO_MAX_FRAME; i++) {
struct videobuf_dmabuf *dma = videobuf_to_dma(vbq->bufs[i]);
for (j = 0; j < dma->sglen; j++) {
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [patch] omap24xxcam: potential buffer overflow
2010-03-10 10:57 [patch] omap24xxcam: potential buffer overflow Dan Carpenter
@ 2010-03-10 21:47 ` Sakari Ailus
0 siblings, 0 replies; 2+ messages in thread
From: Sakari Ailus @ 2010-03-10 21:47 UTC (permalink / raw)
To: Dan Carpenter
Cc: linux-media@vger.kernel.org, Mauro Carvalho Chehab,
Laurent Pinchart, Greg Kroah-Hartman, Trent Piepho, Hans Verkuil,
kernel-janitors@vger.kernel.org
Dan Carpenter wrote:
> The previous loop goes until last == VIDEO_MAX_FRAME, so this could
> potentially go one past the end of the loop.
Hi Dan,
Thanks for the patch!
> Signed-off-by: Dan Carpenter <error27@gmail.com>
>
> diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c
> index 142c327..bedbee9 100644
> --- a/drivers/media/video/omap24xxcam.c
> +++ b/drivers/media/video/omap24xxcam.c
> @@ -1404,7 +1404,7 @@ static int omap24xxcam_mmap_buffers(struct file *file,
> }
>
> size = 0;
> - for (i = first; i <= last; i++) {
> + for (i = first; i <= last && i < VIDEO_MAX_FRAME; i++) {
> struct videobuf_dmabuf *dma = videobuf_to_dma(vbq->bufs[i]);
>
> for (j = 0; j < dma->sglen; j++) {
That function is quite an ugly piece of code... This patch fixes an
obvious bug in it.
Acked-by: Sakari Ailus <sakari.ailus@maxwell.research.nokia.com>
--
Sakari Ailus
sakari.ailus@maxwell.research.nokia.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-03-10 21:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-03-10 10:57 [patch] omap24xxcam: potential buffer overflow Dan Carpenter
2010-03-10 21:47 ` Sakari Ailus
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox