Home » Mailing list archives » linux-kernel » 2008 » April » 29

[10/12] V4L: Fix VIDIOCGAP corruption in ivtv

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: Greg KH
Subject: [10/12] V4L: Fix VIDIOCGAP corruption in ivtv
Date: Tuesday, April 29, 2008 - 11:50 am

2.6.24-stable review patch.  If anyone has any objections, please let us
know.

------------------

From: Alan Cox <alan@lxorguk.ukuu.org.uk>

Frank Bennett reported that ivtv was causing skype to crash. With help
from one of their developers he showed it was a kernel problem.
VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names
that are too long and does not truncate them so corrupts a few bytes of
the app data area.

Possibly the names also want trimming but for now this should fix the
corruption case.

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
(cherry picked from commit d2b213f7b76f187c4391079c7581d3a08b940133)
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/media/video/ivtv/ivtv-ioctl.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/media/video/ivtv/ivtv-ioctl.c
+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
@@ -727,7 +727,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, s
 
 		memset(vcap, 0, sizeof(*vcap));
 		strcpy(vcap->driver, IVTV_DRIVER_NAME);     /* driver name */
-		strcpy(vcap->card, itv->card_name); 	    /* card type */
+		strncpy(vcap->card, itv->card_name,
+				sizeof(vcap->card)-1); 	    /* card type */
 		strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */
 		vcap->version = IVTV_DRIVER_VERSION; 	    /* version */
 		vcap->capabilities = itv->v4l2_cap; 	    /* capabilities */

-- 
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[00/12] 2.6.24-stable review, Greg KH, (Tue Apr 29, 11:49 am)
[01/12] splice: use mapping_gfp_mask, Greg KH, (Tue Apr 29, 11:49 am)
[02/12] fix oops on rmmod capidrv, Greg KH, (Tue Apr 29, 11:49 am)
[03/12] x86: Fix 32-bit x86 MSI-X allocation leakage, Greg KH, (Tue Apr 29, 11:49 am)
[04/12] tehuti: check register size (CVE-2008-1675), Greg KH, (Tue Apr 29, 11:49 am)
[05/12] tehuti: move ioctl perm check closer to function s ..., Greg KH, (Tue Apr 29, 11:49 am)
[06/12] USB: gadget: queue usb USB_CDC_GET_ENCAPSULATED_RE ..., Greg KH, (Tue Apr 29, 11:49 am)
[07/12] JFFS2: Fix free space leak with in-band cleanmarkers, Greg KH, (Tue Apr 29, 11:49 am)
[09/12] USB: remove broken usb-serial num_endpoints check, Greg KH, (Tue Apr 29, 11:49 am)
[09/12] USB: remove broken usb-serial num_endpoints check, Greg KH, (Tue Apr 29, 11:50 am)
[10/12] V4L: Fix VIDIOCGAP corruption in ivtv, Greg KH, (Tue Apr 29, 11:50 am)
[11/12] V4L: cx88: enable radio GPIO correctly, Greg KH, (Tue Apr 29, 11:50 am)
[12/12] ISDN: Do not validate ISDN net device address prio ..., Greg KH, (Tue Apr 29, 11:50 am)
Re: [00/12] 2.6.24-stable review, Jörg-Volker Peetz, (Tue Apr 29, 2:27 pm)
Re: [00/12] 2.6.24-stable review, Willy Tarreau, (Tue Apr 29, 3:45 pm)
Re: [00/12] 2.6.24-stable review, Darren Salt, (Tue Apr 29, 8:21 pm)
Re: [stable] [00/12] 2.6.24-stable review, Greg KH, (Wed Apr 30, 8:39 pm)
Re: [stable] [00/12] 2.6.24-stable review, Darren Salt, (Fri May 2, 8:24 am)
Re: [stable] [00/12] 2.6.24-stable review, Greg KH, (Thu May 8, 10:27 am)