Xi Wang 0a3475eb61 [media] v4l2-ctrls: fix integer overflow in try_set_ext_ctrls() ...

A large cs->count from userspace may overflow the allocation size,
leading to memory corruption.  try_set_ext_ctrls() can be reached
from subdev_do_ioctl() or __video_do_ioctl().

Use kmalloc_array() to avoid the overflow.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

2012-04-18 11:09:38 -03:00

..

common

[media] fc0011: Reduce number of retries

2012-04-09 14:54:11 -03:00

dvb

[media] mxl111sf: remove an unused variable

2012-04-09 14:57:20 -03:00

radio

[media] radio-gemtek: add PnP support for AOpen FX-3D/Pro Radio

2012-04-10 19:53:19 -03:00

rc

[media] ati_remote: add support for Medion X10 Digitainer remote

2012-04-11 02:05:46 -03:00

video

[media] v4l2-ctrls: fix integer overflow in try_set_ext_ctrls()

2012-04-18 11:09:38 -03:00

Kconfig

[media] DVB: dvb-net, make the kconfig text helpful

2011-07-27 17:53:09 -03:00

Makefile

[media] media: Entities, pads and links

2011-03-22 04:53:10 -03:00

media-device.c

[media] media: fix truncated entity specification

2011-12-20 09:31:50 -02:00

media-devnode.c

[media] media: Initialize the media core with subsys_initcall()

2012-03-19 19:02:22 -03:00

media-entity.c

[media] media: Properly handle link flags in link setup, link notify callback

2011-04-17 07:43:32 -03:00