---
 drivers/media/video/v4l2-compat-ioctl32.c |    5 	5 +	0 -	0 !
 1 file changed, 5 insertions(+)

Index: linux-2.6/drivers/media/video/v4l2-compat-ioctl32.c
===================================================================
--- linux-2.6.orig/drivers/media/video/v4l2-compat-ioctl32.c
+++ linux-2.6/drivers/media/video/v4l2-compat-ioctl32.c
@@ -475,6 +475,9 @@ static int get_v4l2_buffer32(struct v4l2
 			return -EFAULT;
 	switch (kp->memory) {
 	case V4L2_MEMORY_MMAP:
+		if (get_user(kp->length, &up->length) ||
+			get_user(kp->m.offset, &up->m.offset))
+			return -EFAULT;
 		break;
 	case V4L2_MEMORY_USERPTR:
 		{