Home » Mailing list archives » linux-kernel » 2008 » October » 18

[patch 18/26] V4L/DVB (9053): fix buffer overflow in uvc-video

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: Greg KH
Subject: [patch 18/26] V4L/DVB (9053): fix buffer overflow in uvc-video
Date: Saturday, October 18, 2008 - 11:48 am

2.6.26-stable review patch.  If anyone has any objections, please let us 
know.

------------------
From: Ralph Loader <suckfish@ihug.co.nz>

Commit fe6c700ff34e68e1eb7991e9c5d18986d0005ac1 upstream

V4L/DVB (9053): fix buffer overflow in uvc-video

There is a buffer overflow in drivers/media/video/uvc/uvc_ctrl.c:

INFO: 0xf2c5ce08-0xf2c5ce0b. First byte 0xa1 instead of 0xcc
INFO: Allocated in uvc_query_v4l2_ctrl+0x3c/0x239 [uvcvideo] age=13 cpu=1 pid=4975
...

A fixed size 8-byte buffer is allocated, and a variable size field is read
into it; there is no particular bound on the size of the field (it is
dependent on hardware and configuration) and it can overflow [also
verified by inserting printk's.]

The patch attempts to size the buffer to the correctly.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/media/video/uvc/uvc_ctrl.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -592,7 +592,7 @@ int uvc_query_v4l2_ctrl(struct uvc_video
 	if (ctrl == NULL)
 		return -EINVAL;
 
-	data = kmalloc(8, GFP_KERNEL);
+	data = kmalloc(ctrl->info->size, GFP_KERNEL);
 	if (data == NULL)
 		return -ENOMEM;
 

-- 
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[patch 00/26] 2.6.26-stable review, Greg KH, (Sat Oct 18, 11:47 am)
[patch 01/26] x86: Reserve FIRST_DEVICE_VECTOR in used_vec ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 02/26] x86: improve UP kernel when CPU-hotplug and ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 03/26] x86, early_ioremap: fix fencepost error, Greg KH, (Sat Oct 18, 11:47 am)
[patch 04/26] tty: Termios locking - sort out real_tty con ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 05/26] sched_rt.c: resch needed in rt_rq_enqueue() ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 06/26] CIFS: make sure we have the right resume inf ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 07/26] b43legacy: Fix failure in rate-adjustment me ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 08/26] modules: fix module &quot;notes&quot; kobject leak, Greg KH, (Sat Oct 18, 11:47 am)
[patch 09/26] fbcon_set_all_vcs: fix kernel crash when swi ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 10/26] libata: always do follow-up SRST if hardrese ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 11/26] libata: fix EH action overwriting in ata_eh_ ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 12/26] libata: LBA28/LBA48 off-by-one bug in ata.h, Greg KH, (Sat Oct 18, 11:47 am)
[patch 13/26] V4L: bttv: Prevent NULL pointer dereference ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 14/26] V4L: zr36067: Fix RGBR pixel format, Greg KH, (Sat Oct 18, 11:47 am)
[patch 15/26] Dont allow splice() to files opened with O_A ..., Greg KH, (Sat Oct 18, 11:47 am)
[patch 16/26] V4L/DVB (8498): uvcvideo: Return sensible mi ..., Greg KH, (Sat Oct 18, 11:48 am)
[patch 17/26] V4L/DVB (8617): uvcvideo: dont use stack-bas ..., Greg KH, (Sat Oct 18, 11:48 am)
[patch 19/26] PCI: disable ASPM per ACPI FADT setting, Greg KH, (Sat Oct 18, 11:48 am)
[patch 20/26] PCI: disable ASPM on pre-1.1 PCIe devices, Greg KH, (Sat Oct 18, 11:48 am)
[patch 18/26] V4L/DVB (9053): fix buffer overflow in uvc-video, Greg KH, (Sat Oct 18, 11:48 am)
[patch 21/26] x86: avoid dereferencing beyond stack + THRE ..., Greg KH, (Sat Oct 18, 11:48 am)
[patch 22/26] Check mapped ranges on sysfs resource files, Greg KH, (Sat Oct 18, 11:48 am)
[patch 23/26] hwmon: (it87) Prevent power-off on Shuttle S ..., Greg KH, (Sat Oct 18, 11:48 am)
[patch 24/26] ACPI: Ignore _BQC object when registering ba ..., Greg KH, (Sat Oct 18, 11:48 am)
[patch 25/26] drm/i915: fix ioremap of a user address for ..., Greg KH, (Sat Oct 18, 11:48 am)
[patch 26/26] DVB: au0828: add support for another USB id ..., Greg KH, (Sat Oct 18, 11:48 am)