Dan Carpenter dd6e2a981b media: omap_vout: potential buffer overflow in vidioc_dqbuf() ... The "b->index" is a u32 the comes from the user in the ioctl. It hasn't been checked. We aren't supposed to use it but we're instead supposed to use the value that gets written to it when we call videobuf_dqbuf(). The videobuf_dqbuf() first memsets it to zero and then re-initializes it inside the videobuf_status() function. It's this final value which we want. Hans Verkuil pointed out that we need to check the return from videobuf_dqbuf(). I ended up doing a little cleanup related to that as well. Fixes: 72915e851d ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>		2019-05-08 13:58:49 -04:00
..
Kconfig	media: Kconfig files: use the right help coding style	2019-03-20 06:47:51 -04:00
Makefile
omap_vout_vrfb.c	media: platform: fix some 64-bits warnings	2018-04-17 05:50:00 -04:00
omap_vout_vrfb.h
omap_vout.c	media: omap_vout: potential buffer overflow in vidioc_dqbuf()	2019-05-08 13:58:49 -04:00
omap_voutdef.h	media: platform: fix several typos	2019-03-01 09:35:21 -05:00
omap_voutlib.c	[media] omap_vout: Switch to use the video/omapfb_dss.h header file	2016-06-03 16:06:39 +03:00
omap_voutlib.h