aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMárton Németh <nm127@freemail.hu>2009-04-15 09:01:58 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2009-06-16 18:20:37 -0300
commit9086c7b994dcd6d06723bcb48a23af3e3f75e002 (patch)
tree79a282affdb56fde1edac687343089d96e8bb2e3
parent513846ece644662dc0914f7b518ed1bd29953fc3 (diff)
V4L/DVB (11573): uvcvideo: Prevent invormation loss with removing implicit casting
The uvcvideo driver supports only one input, which is input 0. For all other input index the return value shall be EINVAL. This patch fixes the problem when the value 0x80000000 was incorrectly casted and treated as a zero value. The patch was tested with v4l-test 0.10 [2] with CNF7129 webcam found on EeePC 901. References: [1] V4L2 API specification, revision 0.24 http://v4l2spec.bytesex.org/spec/r11217.htm [2] v4l-test: Test environment for Video For Linux Two API http://v4l-test.sourceforge.net/ [Modified by Laurent Pinchart] Invalid input value (u32)-1 would be accepted due to integer overflow. Make sure the driver rejects it and returns -EINVAL. Signed-off-by: Márton Németh <nm127@freemail.hu> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
-rw-r--r--drivers/media/video/uvc/uvc_v4l2.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
index 2a80caa54fb..43b05a7ecdc 100644
--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
@@ -648,7 +648,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
case VIDIOC_S_INPUT:
{
- u8 input = *(u32 *)arg + 1;
+ u32 input = *(u32 *)arg + 1;
if ((ret = uvc_acquire_privileges(handle)) < 0)
return ret;
@@ -660,7 +660,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
break;
}
- if (input > video->selector->selector.bNrInPins)
+ if (input == 0 || input > video->selector->selector.bNrInPins)
return -EINVAL;
return uvc_query_ctrl(video->dev, SET_CUR, video->selector->id,