Ricardo Ribalda 41ebaa5e0e media: uvcvideo: Fix OOB read ...

If the index provided by the user is bigger than the mask size, we might do
an out of bound read.

CC: stable@kernel.org
Fixes: 40140eda661e ("media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU")
Reported-by: Zubin Mithra <zsm@chromium.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

2023-09-14 23:31:55 +02:00

..

Kconfig

usb: uvc: move uvc_fmts and uvc_format_by_guid to own compile unit

2023-01-31 09:40:42 +01:00

Makefile

media: uvcvideo: Add a metadata device node

2018-01-04 06:41:47 -05:00

uvc_ctrl.c

media: uvcvideo: Fix OOB read

2023-09-14 23:31:55 +02:00

uvc_debugfs.c

media: usb: uvc: no need to check return value of debugfs_create functions

2020-09-26 10:15:17 +02:00

uvc_driver.c

media: uvcvideo: Constify descriptor buffers

2023-06-09 14:11:57 +01:00

uvc_entity.c

media: uvcvideo: Handle cameras with invalid descriptors

2023-01-15 23:45:08 +02:00

uvc_isight.c

media: uvcvideo: Fix comment blocks style

2022-07-16 08:48:42 +01:00

uvc_metadata.c

media: uvcvideo: Use dev->name for querycap()

2021-09-30 10:07:47 +02:00

uvc_queue.c

media: uvcvideo: Fix comment blocks style

2022-07-16 08:48:42 +01:00

uvc_status.c

media: uvcvideo: Fix race condition with usb_kill_urb

2023-01-15 23:45:15 +02:00

uvc_v4l2.c

media: uvcvideo: Fix menu count handling for userspace XU mappings

2023-07-28 10:20:10 +02:00

uvc_video.c

media: uvcvideo: Constify formats, frames and intervals

2023-06-09 14:11:55 +01:00

uvcvideo.h

media: uvcvideo: Constify formats, frames and intervals

2023-06-09 14:11:55 +01:00