From patchwork Thu May 17 08:58:25 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 10405983 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7AB1A60155 for ; Thu, 17 May 2018 08:58:51 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6BC4C28984 for ; Thu, 17 May 2018 08:58:51 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5ED9E289BB; Thu, 17 May 2018 08:58:51 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D8B7D28984 for ; Thu, 17 May 2018 08:58:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751395AbeEQI6r (ORCPT ); Thu, 17 May 2018 04:58:47 -0400 Received: from aserp2120.oracle.com ([141.146.126.78]:34022 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750891AbeEQI6q (ORCPT ); Thu, 17 May 2018 04:58:46 -0400 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w4H8u5Zw032600; Thu, 17 May 2018 08:58:43 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : mime-version : content-type; s=corp-2017-10-26; bh=W7FgCpSWd1oLTB51U8+xuiCzhUnRkqRzIY5tGe0fPF4=; b=KOpBBtPrxrCXhB8UFA5LDmzsHDfvggsiMwtE/JznY1CJ4mGQZBGzfVnAyqAT7hmskry3 +Ih/oaPTlCKzEYGkXVPkHLTGsUAn5ceC77hepjFREl1om5S/9fji3WMb8bkXOcO7Ql2f GIfrtDnsNpmemtF2ooMaMalG/TYxW4VAEM3uBXf5sruC3skWLGfAzIUCC8Oja/gWxhH0 H7ARTgqtZ4A/3FTROXsjitcnCwYHkh61SptGJbv3cNcrBuQ+gKJ/FZ8+uJm6gISBZprY gqepTEtj+VApyCA7pWzB3OIqI+wJnEntjCJa+xFiv3b+IrzRoktrzhlQuyQODH7KxZql 0Q== Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp2120.oracle.com with ESMTP id 2hx29w89k4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 17 May 2018 08:58:43 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w4H8whY5013766 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 17 May 2018 08:58:43 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w4H8whZp023453; Thu, 17 May 2018 08:58:43 GMT Received: from mwanda (/197.254.35.146) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 17 May 2018 01:58:42 -0700 Date: Thu, 17 May 2018 11:58:25 +0300 From: Dan Carpenter To: Hans Verkuil Cc: Mauro Carvalho Chehab , linux-media@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [PATCH] media: vivid: potential integer overflow in vidioc_g_edid() Message-ID: <20180517085825.GA4250@mwanda> MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email haha only kidding User-Agent: Mutt/1.9.4 (2018-02-28) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8895 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1805170083 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If we pick a very large "edid->blocks" value then the "edid->start_block + edid->blocks" addition could wrap around. Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") Signed-off-by: Dan Carpenter diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c index e5914be0e12d..be531caa2cdf 100644 --- a/drivers/media/platform/vivid/vivid-vid-common.c +++ b/drivers/media/platform/vivid/vivid-vid-common.c @@ -860,7 +860,7 @@ int vidioc_g_edid(struct file *file, void *_fh, return -ENODATA; if (edid->start_block >= dev->edid_blocks) return -EINVAL; - if (edid->start_block + edid->blocks > dev->edid_blocks) + if (edid->blocks > dev->edid_blocks - edid->start_block) edid->blocks = dev->edid_blocks - edid->start_block; if (adap) cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);