* [PATCH] [media] media/core: copy user v4l2_buffer.length in DMABUF case
@ 2016-02-17 10:47 Kevin Grandemange
2016-02-17 11:21 ` Hans Verkuil
0 siblings, 1 reply; 2+ messages in thread
From: Kevin Grandemange @ 2016-02-17 10:47 UTC (permalink / raw)
To: linux-media; +Cc: Kevin Grandemange
in __qbuf_dmabuf, we check the dmabuf size against the plane size.
In the monoplanar case, this length was not copied from the userspace
and we were getting a random value.
Signed-off-by: Kevin Grandemange <grandemange.kevin@gmail.com>
---
drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 8fd84a6..af0e01c 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -482,7 +482,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
return -EFAULT;
break;
case V4L2_MEMORY_DMABUF:
- if (get_user(kp->m.fd, &up->m.fd))
+ if (get_user(kp->length, &up->length) ||
+ get_user(kp->m.fd, &up->m.fd))
return -EFAULT;
break;
}
--
2.7.0.rc3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] [media] media/core: copy user v4l2_buffer.length in DMABUF case
2016-02-17 10:47 [PATCH] [media] media/core: copy user v4l2_buffer.length in DMABUF case Kevin Grandemange
@ 2016-02-17 11:21 ` Hans Verkuil
0 siblings, 0 replies; 2+ messages in thread
From: Hans Verkuil @ 2016-02-17 11:21 UTC (permalink / raw)
To: Kevin Grandemange, linux-media
Has already been fixed.
But thanks anyway :-)
Regards,
Hans
On 02/17/16 11:47, Kevin Grandemange wrote:
> in __qbuf_dmabuf, we check the dmabuf size against the plane size.
>
> In the monoplanar case, this length was not copied from the userspace
> and we were getting a random value.
>
> Signed-off-by: Kevin Grandemange <grandemange.kevin@gmail.com>
> ---
> drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> index 8fd84a6..af0e01c 100644
> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> @@ -482,7 +482,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
> return -EFAULT;
> break;
> case V4L2_MEMORY_DMABUF:
> - if (get_user(kp->m.fd, &up->m.fd))
> + if (get_user(kp->length, &up->length) ||
> + get_user(kp->m.fd, &up->m.fd))
> return -EFAULT;
> break;
> }
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-02-17 11:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-02-17 10:47 [PATCH] [media] media/core: copy user v4l2_buffer.length in DMABUF case Kevin Grandemange
2016-02-17 11:21 ` Hans Verkuil
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).