linux/drivers/media/video/zoran
Xi Wang 32898a1454 [media] zoran: fix integer overflow in setup_window()
`clipcount' is from userspace and thus needs validation.  Otherwise,
a large `clipcount' could overflow the vmalloc() size, leading to
out-of-bounds access.

| setup_window()
| zoran_s_fmt_vid_overlay()
| __video_do_ioctl()
| video_ioctl2()

Use 2048 as the maximum `clipcount'.  Also change the corresponding
parameter type to `unsigned int'.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2012-04-19 09:11:25 -03:00
..
Kconfig
Makefile
videocodec.c V4L/DVB: drivers/media/video/zoran: Use kmemdup 2010-08-02 15:04:04 -03:00
videocodec.h Fix common misspellings 2011-03-31 11:26:23 -03:00
zoran.h [media] Stop using linux/version.h on most video drivers 2011-07-27 17:53:12 -03:00
zoran_card.c [media] Stop using linux/version.h on most video drivers 2011-07-27 17:53:12 -03:00
zoran_card.h
zoran_device.c module_param: make bool parameters really bool (drivers & misc) 2012-01-13 09:32:20 +10:30
zoran_device.h
zoran_driver.c [media] zoran: fix integer overflow in setup_window() 2012-04-19 09:11:25 -03:00
zoran_procfs.c
zoran_procfs.h
zr36016.c
zr36016.h
zr36050.c fix typos concerning "initiali[zs]e" 2010-06-16 18:05:05 +02:00
zr36050.h
zr36057.h
zr36060.c module_param: make bool parameters really bool (drivers & misc) 2012-01-13 09:32:20 +10:30
zr36060.h