Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-17 10:26:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
linux/drivers/media/video
History
Ralph Loader fe6c700ff3 V4L/DVB (9053): fix buffer overflow in uvc-video 
There is a buffer overflow in drivers/media/video/uvc/uvc_ctrl.c:

INFO: 0xf2c5ce08-0xf2c5ce0b. First byte 0xa1 instead of 0xcc
INFO: Allocated in uvc_query_v4l2_ctrl+0x3c/0x239 [uvcvideo] age=13 cpu=1 pid=4975
...

A fixed size 8-byte buffer is allocated, and a variable size field is read
into it; there is no particular bound on the size of the field (it is
dependent on hardware and configuration) and it can overflow [also
verified by inserting printk's.]

The patch attempts to size the buffer to the correctly.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2008-10-04 23:04:32 -03:00
..
au0828
V4L/DVB (8805): Steven Toth email address change
2008-09-03 18:37:21 -03:00
bt8xx
V4L/DVB (8955): bttv: Prevent NULL pointer dereference in radio_open
2008-10-04 22:38:12 -03:00
cpia2
V4L/DVB (8885): cpia2_usb: fix memory leak
2008-09-29 08:26:10 -03:00
cx18
V4L/DVB (8919): cx18: Fix tuner audio input for Compro H900 cards
2008-10-04 22:27:16 -03:00
cx88
V4L/DVB (8904): cx88: add missing unlock_kernel
2008-09-29 11:31:19 -03:00
cx23885
V4L/DVB (8805): Steven Toth email address change
2008-09-03 18:37:21 -03:00
cx25840
V4L/DVB (8805): Steven Toth email address change
2008-09-03 18:37:21 -03:00
em28xx
V4L/DVB (8967): Use correct XC3028L firmware for AMD ATI TV Wonder 600
2008-10-04 22:43:41 -03:00
et61x251
V4L/DVB (8880): PATCH: Fix parents on some webcam drivers
2008-09-04 18:27:35 -03:00
gspca
V4L/DVB (8933): gspca: Disable light frquency for zc3xx cs2102 Kokom.
2008-10-04 22:34:20 -03:00
ivtv
V4L/DVB (8648): ivtv: improve CC support
2008-09-03 18:36:25 -03:00
ovcamchip
V4L/DVB (8245): ovcamchip: Delete stray I2C bus ID
2008-07-20 07:18:34 -03:00
pvrusb2
V4L/DVB (8892): pvrusb2: Handle USB ID 2040:2950 same as 2040:2900
2008-09-29 08:27:25 -03:00
pwc
V4L/DVB (8757): v4l-dvb: fix a bunch of sparse warnings
2008-09-03 18:37:13 -03:00
saa7134
V4L/DVB (8534): remove select's of FW_LOADER
2008-07-27 12:24:37 -03:00
sn9c102
V4L/DVB (8880): PATCH: Fix parents on some webcam drivers
2008-09-04 18:27:35 -03:00
usbvideo
V4L/DVB (8779): v4l: fix more incorrect video_register_device result checks
2008-09-03 18:37:17 -03:00
usbvision
V4L/DVB (8523): v4l2-dev: remove unused type and type2 field from video_device
2008-07-27 11:07:10 -03:00
uvc
V4L/DVB (9053): fix buffer overflow in uvc-video
2008-10-04 23:04:32 -03:00
zc0301
V4L/DVB (8880): PATCH: Fix parents on some webcam drivers
2008-09-04 18:27:35 -03:00
adv7170.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
adv7175.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
arv.c
V4L/DVB (8563): fix drivers/media/video/arv.c compilation
2008-08-06 06:57:07 -03:00
bt819.c
V4L/DVB (8316): bt819: Fix a debug message
2008-07-20 07:24:26 -03:00
bt856.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
bt866.c
V4L/DVB (6819): i2c: fix drivers/media/video/bt866.c
2007-12-13 17:58:05 -02:00
btcx-risc.c
V4L/DVB (8757): v4l-dvb: fix a bunch of sparse warnings
2008-09-03 18:37:13 -03:00
btcx-risc.h
V4L/DVB (8757): v4l-dvb: fix a bunch of sparse warnings
2008-09-03 18:37:13 -03:00
bw-qcam.c
V4L/DVB (8779): v4l: fix more incorrect video_register_device result checks
2008-09-03 18:37:17 -03:00
bw-qcam.h
…
c-qcam.c
V4L/DVB (8779): v4l: fix more incorrect video_register_device result checks
2008-09-03 18:37:17 -03:00
cafe_ccic-regs.h
V4L/DVB (5690): Cafe_ccic: Properly power down the sensor
2007-05-22 16:16:27 -03:00
cafe_ccic.c
V4L/DVB (8960): drivers/media/video/cafe_ccic.c needs mm.h
2008-10-04 22:40:18 -03:00
compat_ioctl32.c
V4L/DVB (8434): Fix x86_64 compilation and move some macros to v4l2-ioctl.h
2008-07-23 19:00:22 -03:00
cpia_pp.c
header cleaning: don't include smp_lock.h when not used
2007-05-08 11:15:07 -07:00
cpia_usb.c
V4L/DVB (7518): media/video/ replace remaining __FUNCTION__ occurrences
2008-04-24 14:07:59 -03:00
cpia.c
V4L/DVB (8779): v4l: fix more incorrect video_register_device result checks
2008-09-03 18:37:17 -03:00
cpia.h
V4L/DVB (8430): videodev: move some functions from v4l2-dev.h to v4l2-common.h or v4l2-ioctl.h
2008-07-23 19:00:17 -03:00
cs53l32a.c
Remove newline from the description of module parameters
2008-08-01 12:46:41 -07:00
cs5345.c
Remove newline from the description of module parameters
2008-08-01 12:46:41 -07:00
cs8420.h
…
cx2341x.c
V4L/DVB (8377): ivtv/cx18: ensure the default control values are correct
2008-07-20 07:28:07 -03:00
dabusb.c
V4L/DVB (8844): dabusb_fpga_download(): fix a memory leak
2008-09-03 18:37:55 -03:00
dabusb.h
…
dpc7146.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
font.h
…
hexium_gemini.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
hexium_orion.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
ibmmpeg2.h
…
indycam.c
drivers/media/: Spelling fixes
2008-02-03 17:18:59 +02:00
indycam.h
…
ir-kbd-i2c.c
V4L/DVB (8395): saa7134: Fix Kbuild dependency of ir-kbd-i2c
2008-07-20 07:29:03 -03:00
Kconfig
V4L/DVB (8558): media/video/Kconfig: fix a typo
2008-08-06 06:57:03 -03:00
ks0127.c
V4L/DVB (8757): v4l-dvb: fix a bunch of sparse warnings
2008-09-03 18:37:13 -03:00
ks0127.h
…
m52790.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
Makefile
V4L/DVB (8726): link tuner before saa7134
2008-09-03 18:37:07 -03:00
meye.c
V4L/DVB (8749): Fix error code, when camera is not turned on by sonypi
2008-09-03 18:37:10 -03:00
meye.h
Convert files to UTF-8 and some cleanups
2007-10-19 23:21:04 +02:00
msp3400-driver.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
msp3400-driver.h
V4L/DVB (5355): Add VIDIOC_G_CHIP_IDENT to various i2c modules
2007-04-27 15:43:50 -03:00
msp3400-kthreads.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
mt9m001.c
V4L/DVB (8428): videodev: rename 'dev' to 'parent'
2008-07-23 16:42:49 -03:00
mt9v022.c
Remove newline from the description of module parameters
2008-08-01 12:46:41 -07:00
mxb.c
V4L/DVB (8757): v4l-dvb: fix a bunch of sparse warnings
2008-09-03 18:37:13 -03:00
mxb.h
…
ov511.c
V4L/DVB (8905): ov511: fix exposure sysfs attribute bug
2008-09-29 11:32:32 -03:00
ov511.h
V4L/DVB (8430): videodev: move some functions from v4l2-dev.h to v4l2-common.h or v4l2-ioctl.h
2008-07-23 19:00:17 -03:00
ov7670.c
V4L/DVB (8381): ov7670: fix compile warnings
2008-07-20 07:28:27 -03:00
pms.c
V4L/DVB (8728): 1-make-pms-not-autoprobe-when-builtin update
2008-09-03 18:37:09 -03:00
pxa_camera.c
Merge Linus' latest into master
2008-08-08 19:18:18 +01:00
s2255drv.c
V4L/DVB (8963): s2255drv field count fix
2008-10-04 22:42:58 -03:00
saa711x_regs.h
V4L/DVB (4551): Added register aliases for saa711x registers, instead of using reg numbers
2006-09-26 12:30:34 -03:00
saa717x.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
saa5246a.c
V4L/DVB (8523): v4l2-dev: remove unused type and type2 field from video_device
2008-07-27 11:07:10 -03:00
saa5246a.h
V4L/DVB (5197): Convert to generic boolean-values
2007-02-21 13:35:16 -02:00
saa5249.c
V4L/DVB (8523): v4l2-dev: remove unused type and type2 field from video_device
2008-07-27 11:07:10 -03:00
saa6588.c
v4l-dvb: remove legacy checks to allow support for kernels < 2.6.10
2008-07-20 07:17:52 -03:00
saa7110.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
saa7111.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
saa7114.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
saa7115.c
V4L/DVB (8790): saa7115: call i2c_set_clientdata only when state != NULL
2008-09-03 18:37:18 -03:00
saa7121.h
…
saa7127.c
V4L/DVB (8379): saa7127: Make device detection optional
2008-07-20 07:28:17 -03:00
saa7146.h
…
saa7146reg.h
…
saa7185.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
saa7191.c
V4L/DVB (6148): Fix a warning at saa7191_probe
2007-09-14 13:13:42 -03:00
saa7191.h
…
se401.c
V4L/DVB (8779): v4l: fix more incorrect video_register_device result checks
2008-09-03 18:37:17 -03:00
se401.h
V4L/DVB (8430): videodev: move some functions from v4l2-dev.h to v4l2-common.h or v4l2-ioctl.h
2008-07-23 19:00:17 -03:00
sh_mobile_ceu_camera.c
V4L/DVB (8609): media: Clean up platform_driver_unregister() bogosity.
2008-08-06 06:57:30 -03:00
soc_camera_platform.c
V4L/DVB (8609): media: Clean up platform_driver_unregister() bogosity.
2008-08-06 06:57:30 -03:00
soc_camera.c
V4L/DVB (8610): Add suspend/resume capabilities to soc_camera.
2008-08-06 06:57:32 -03:00
stk-sensor.c
V4L/DVB (7104): stk-sensor.c: make 2 functions static
2008-02-18 11:15:08 -03:00
stk-webcam.c
V4L/DVB (8523): v4l2-dev: remove unused type and type2 field from video_device
2008-07-27 11:07:10 -03:00
stk-webcam.h
V4L/DVB (7104): stk-sensor.c: make 2 functions static
2008-02-18 11:15:08 -03:00
stradis.c
V4L/DVB (8523): v4l2-dev: remove unused type and type2 field from video_device
2008-07-27 11:07:10 -03:00
stv680.c
V4L/DVB (8779): v4l: fix more incorrect video_register_device result checks
2008-09-03 18:37:17 -03:00
stv680.h
…
tcm825x.c
V4L/DVB (7897): TCM825x: Include invertation of image mirroring in configuration
2008-07-20 07:06:01 -03:00
tcm825x.h
V4L/DVB (7897): TCM825x: Include invertation of image mirroring in configuration
2008-07-20 07:06:01 -03:00
tda7432.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
tda9840.c
v4l-dvb: remove legacy checks to allow support for kernels < 2.6.10
2008-07-20 07:17:52 -03:00
tda9840.h
…
tda9875.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
tea6415c.c
v4l-dvb: remove legacy checks to allow support for kernels < 2.6.10
2008-07-20 07:17:52 -03:00
tea6415c.h
…
tea6420.c
v4l-dvb: remove legacy checks to allow support for kernels < 2.6.10
2008-07-20 07:17:52 -03:00
tea6420.h
…
tlv320aic23b.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
tuner-3036.c
…
tuner-core.c
V4L/DVB (8430): videodev: move some functions from v4l2-dev.h to v4l2-common.h or v4l2-ioctl.h
2008-07-23 19:00:17 -03:00
tvaudio.c
V4L/DVB (8246): tvaudio: Stop I2C driver ID abuse
2008-07-20 07:18:38 -03:00
tveeprom.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
tvp5150_reg.h
…
tvp5150.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
upd64031a.c
i2c: Convert remaining new-style drivers to use module aliasing
2008-05-18 20:49:40 +02:00
upd64083.c
i2c: Convert remaining new-style drivers to use module aliasing
2008-05-18 20:49:40 +02:00
v4l1-compat.c
V4L/DVB (8430): videodev: move some functions from v4l2-dev.h to v4l2-common.h or v4l2-ioctl.h
2008-07-23 19:00:17 -03:00
v4l2-common.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
v4l2-dev.c
V4L/DVB (8750): V4L: check inval in video_register_device_index()
2008-09-03 18:37:11 -03:00
v4l2-int-device.c
V4L/DVB (7485): v4l2-int-device.c: add MODULE_LICENSE
2008-04-01 19:35:47 -03:00
v4l2-ioctl.c
V4L/DVB (8681): v4l2-ioctl.c: fix warning
2008-09-03 18:36:41 -03:00
videobuf-core.c
PAGE_ALIGN(): correctly handle 64-bit values on 32-bit architectures
2008-07-24 10:47:21 -07:00
videobuf-dma-contig.c
V4L/DVB (8425): v4l: fix checkpatch errors introduced by recent commits
2008-07-23 08:09:21 -03:00
videobuf-dma-sg.c
V4L/DVB (8340): videobuf: Fix gather spelling
2008-07-20 07:25:32 -03:00
videobuf-dvb.c
v4l-dvb: remove legacy checks to allow support for kernels < 2.6.10
2008-07-20 07:17:52 -03:00
videobuf-vmalloc.c
V4L/DVB (8525): fix a few assorted spelling mistakes.
2008-07-27 11:07:13 -03:00
videocodec.c
V4L/DVB (7580): Fix concurrent read from /proc/videocodecs
2008-04-24 14:09:40 -03:00
videocodec.h
…
vino.c
V4L/DVB (8564): fix vino driver build error
2008-08-06 06:57:08 -03:00
vino.h
…
vivi.c
V4L/DVB (8842): vivi_release(): fix use-after-free
2008-09-03 18:37:53 -03:00
vp27smpx.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
vpx3220.c
V4L/DVB (8488): videodev: remove some CONFIG_VIDEO_V4L1_COMPAT code from v4l2-dev.h
2008-07-26 13:18:11 -03:00
w9966.c
V4L/DVB (8779): v4l: fix more incorrect video_register_device result checks
2008-09-03 18:37:17 -03:00
w9968cf_decoder.h
…
w9968cf_vpp.h
…
w9968cf.c
V4L/DVB (8883): w9968cf: Fix order of usb_alloc_urb validation
2008-09-29 08:24:57 -03:00
w9968cf.h
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
wm8739.c
V4L/DVB (8789): wm8739: remove wrong kfree
2008-09-10 23:18:32 -03:00
wm8775.c
V4L/DVB (8487): videodev: replace videodev.h includes by videodev2.h where possible
2008-07-26 13:11:36 -03:00
zoran_card.c
V4L/DVB (8957): zr36067: Restore the default pixel format
2008-10-04 22:38:39 -03:00
zoran_card.h
V4L/DVB (8499): zr36067: Rework device memory allocation
2008-07-26 13:18:27 -03:00
zoran_device.c
V4L/DVB (7968): zoran: endianness annotations
2008-06-05 06:35:52 -03:00
zoran_device.h
IRQ: Maintain regs pointer globally rather than passing to IRQ handlers
2006-10-05 15:10:12 +01:00
zoran_driver.c
V4L/DVB (8961): zr36067: Fix RGBR pixel format
2008-10-04 22:40:33 -03:00
zoran_procfs.c
drivers: use non-racy method for proc entries creation (2)
2008-04-29 08:06:22 -07:00
zoran_procfs.h
…
zoran.h
V4L/DVB (7968): zoran: endianness annotations
2008-06-05 06:35:52 -03:00
zr364xx.c
V4L/DVB (8523): v4l2-dev: remove unused type and type2 field from video_device
2008-07-27 11:07:10 -03:00
zr36016.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
zr36016.h
…
zr36050.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
zr36050.h
…
zr36057.h
…
zr36060.c
V4L/DVB (7094): static memory
2008-04-24 13:42:20 -03:00
zr36060.h
…