[media] zoran: fix integer overflow in setup_window()
`clipcount' is from userspace and thus needs validation. Otherwise, a large `clipcount' could overflow the vmalloc() size, leading to out-of-bounds access. | setup_window() | zoran_s_fmt_vid_overlay() | __video_do_ioctl() | video_ioctl2() Use 2048 as the maximum `clipcount'. Also change the corresponding parameter type to `unsigned int'. Signed-off-by: NXi Wang <xi.wang@gmail.com> Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
Showing
想要评论请 注册 或 登录