Re: [RFC,PATCH] VIDIOC_G_EXT_CTRLS does not handle NULL pointer correctly

["Németh Márton" <nm127@freemail.hu>]

Laurent Pinchart wrote:
> Hi Mauro,
> 
> On Wednesday 10 June 2009 23:58:31 Laurent Pinchart wrote:
>> On Wednesday 10 June 2009 15:53:57 Mauro Carvalho Chehab wrote:
>>> Em Wed, 10 Jun 2009 10:52:28 -0300
>>>
>>> Mauro Carvalho Chehab <mchehab@infradead.org> escreveu:
>>>> Em Mon, 25 May 2009 11:16:34 -0300
>>>>
>>>> Mauro Carvalho Chehab <mchehab@infradead.org> escreveu:
>>>>> Em Mon, 25 May 2009 13:17:02 +0200
>>>>>
>>>>> Laurent Pinchart <laurent.pinchart@skynet.be> escreveu:
>>>>>> Hi everybody,
>>>>>>
>>>>>> Márton Németh found an integer overflow bug in the extended control
>>>>>> ioctl handling code. This affects both video_usercopy and
>>>>>> video_ioctl2. See http://bugzilla.kernel.org/show_bug.cgi?id=13357
>>>>>> for a detailed description of the problem.
>>>>>>
>>>>>>
>>>>>> Restricting v4l2_ext_controls::count to values smaller than
>>>>>> KMALLOC_MAX_SIZE / sizeof(struct v4l2_ext_control) should be
>>>>>> enough, but we might want to restrict the value even further. I'd
>>>>>> like opinions on this.
>>>>> Seems fine to my eyes, but being so close to kmalloc size doesn't
>>>>> seem to be a good idea. It seems better to choose an arbitrary size
>>>>> big enough to handle all current needs.
>>>> I'll apply the current version, but I still think we should restrict it
>>>> to a lower value.
>>> Hmm... SOB is missing. Márton and Laurent, could you please sign it
>> Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
> 
> Márton reminded me that the patch has still not been applied.
> 
> Please replace the above SOB line with
> 
> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

Tested-by: Márton Németh <nm127@freemail.hu>