Re: [patch -longterm] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()

2012-01-04 Thread Dan Carpenter
On Tue, Jan 03, 2012 at 12:55:39PM -0800, Greg KH wrote: > Ok, can someone please send me the "accepted" version of this patch for > inclusion in the 2.6.32-stable tree? > Sorry for that. Holidays and all. I'll send a patch tomorrow. regards, dan carpenter signature.asc Description: Digital

Re: [patch -longterm] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()

2012-01-03 Thread Greg KH
On Thu, Dec 15, 2011 at 07:50:30AM -0200, Mauro Carvalho Chehab wrote: > On 15-12-2011 07:33, Hans Verkuil wrote: > > On Thursday, December 15, 2011 10:21:41 Mauro Carvalho Chehab wrote: > >> On 15-12-2011 04:34, Dan Carpenter wrote: > >>> On a 32bit system the multiplication here could overflow.

Re: [patch -longterm] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()

2011-12-15 Thread Mauro Carvalho Chehab
On 15-12-2011 07:33, Hans Verkuil wrote: > On Thursday, December 15, 2011 10:21:41 Mauro Carvalho Chehab wrote: >> On 15-12-2011 04:34, Dan Carpenter wrote: >>> On a 32bit system the multiplication here could overflow. p->count is >>> used in some of the V4L drivers. >> >> ULONG_MAX / sizeof(v4l2_

Re: [patch -longterm] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()

2011-12-15 Thread Hans Verkuil
On Thursday, December 15, 2011 10:21:41 Mauro Carvalho Chehab wrote: > On 15-12-2011 04:34, Dan Carpenter wrote: > > On a 32bit system the multiplication here could overflow. p->count is > > used in some of the V4L drivers. > > ULONG_MAX / sizeof(v4l2_ext_control) is too much. This ioctl is used

Re: [patch -longterm] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()

2011-12-15 Thread Mauro Carvalho Chehab
On 15-12-2011 04:34, Dan Carpenter wrote: > On a 32bit system the multiplication here could overflow. p->count is > used in some of the V4L drivers. ULONG_MAX / sizeof(v4l2_ext_control) is too much. This ioctl is used on things like setting MPEG paramenters, where several parameters need adjustme

[patch -longterm] V4L/DVB: v4l2-ioctl: integer overflow in video_usercopy()

2011-12-14 Thread Dan Carpenter
On a 32bit system the multiplication here could overflow. p->count is used in some of the V4L drivers. Signed-off-by: Dan Carpenter --- This is a patch against the 2.6.32-longterm kernel. In the stock kernel, this code was totally rewritten and fixed in 2010 by d14e6d76ebf "[media] v4l: Add mul