summaryrefslogtreecommitdiff
path: root/drivers/media/platform
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2018-05-17 04:58:25 -0400
committerMauro Carvalho Chehab <mchehab+samsung@kernel.org>2018-05-28 16:12:07 -0400
commit9329e7b03c6998cae2d2ba75dd697b07147f3830 (patch)
treec95948a0b01d4ce22dbde827b287fa894e23e6dd /drivers/media/platform
parenta3d71f256c8a8b5d51ea0dfd09cd85ce3a09d9e1 (diff)
media: vivid: potential integer overflow in vidioc_g_edid()
If we pick a very large "edid->blocks" value then the "edid->start_block + edid->blocks" addition could wrap around. Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Diffstat (limited to 'drivers/media/platform')
-rw-r--r--drivers/media/platform/vivid/vivid-vid-common.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c
index e5914be0e12d..be531caa2cdf 100644
--- a/drivers/media/platform/vivid/vivid-vid-common.c
+++ b/drivers/media/platform/vivid/vivid-vid-common.c
@@ -860,7 +860,7 @@ int vidioc_g_edid(struct file *file, void *_fh,
return -ENODATA;
if (edid->start_block >= dev->edid_blocks)
return -EINVAL;
- if (edid->start_block + edid->blocks > dev->edid_blocks)
+ if (edid->blocks > dev->edid_blocks - edid->start_block)
edid->blocks = dev->edid_blocks - edid->start_block;
if (adap)
cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);