linux/drivers/media/usb
Vladis Dronov d5468d7afa [media] usbvision: revert commit 588afcc1
Commit 588afcc1c0 ("[media] usbvision fix overflow of interfaces
array")' should be reverted, because:

* "!dev->actconfig->interface[ifnum]" won't catch a case where the value
is not NULL but some garbage. This way the system may crash later with
GPF.

* "(ifnum >= USB_MAXINTERFACES)" does not cover all the error
conditions. "ifnum" should be compared to "dev->actconfig->
desc.bNumInterfaces", i.e. compared to the number of "struct
usb_interface" kzalloc()-ed, not to USB_MAXINTERFACES.

* There is a "struct usb_device" leak in this error path, as there is
usb_get_dev(), but no usb_put_dev() on this path.

* There is a bug of the same type several lines below with number of
endpoints. The code is accessing hard-coded second endpoint
("interface->endpoint[1].desc") which may not exist. It would be great
to handle this in the same patch too.

* All the concerns above are resolved by already-accepted commit fa52bd50
("[media] usbvision: fix crash on detecting device with invalid
configuration")

* Mailing list message:
http://www.spinics.net/lists/linux-media/msg94832.html

Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: <stable@vger.kernel.org>      # for v4.5
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-04-20 15:58:54 -03:00
..
airspy [media] airspy: fix bit set/clean mess on s->flags 2016-03-01 10:48:17 -03:00
as102 [media] drivers/media/usb/as102: constify as102_priv_ops_t structure 2016-02-01 07:31:48 -02:00
au0828 [media] Revert "[media] media: au0828 change to use Managed Media Controller API" 2016-03-31 15:09:04 -03:00
b2c2 [media] media: change email address 2016-01-25 12:01:08 -02:00
cpia2 [media] usb/cpia2_core: clean up a min_t() cast 2016-02-19 08:10:32 -02:00
cx231xx [media] media_device: move allocation out of media_device_*_init 2016-02-23 07:19:39 -03:00
dvb-usb [media] dw2102: add support for TeVii S662 2016-03-03 14:36:36 -03:00
dvb-usb-v2 [media] rtl2832: improve slave TS control 2016-03-03 09:26:49 -03:00
em28xx [media] em28xx: fix Terratec Grabby AC97 codec detection 2016-03-05 09:04:10 -03:00
go7007 [media] go7007: constify go7007_hpi_ops structures 2016-02-01 07:34:07 -02:00
gspca [media] touptek: cast char types on %x printk 2016-03-10 13:37:45 -03:00
hackrf Merge branch 'patchwork' into v4l_for_linus 2016-01-11 11:13:27 -02:00
hdpvr [media] hdpvr: hide unused variable 2016-02-01 13:14:27 -02:00
msi2500 [media] msi2500: Delete an unnecessary check in msi2500_set_usb_adc() 2016-01-25 15:15:39 -02:00
pvrusb2 [media] pvrusb2: don't go past buf array 2016-02-23 07:20:47 -03:00
pwc [media] pwc: Add USB id for Philips Spc880nc webcam 2016-02-01 10:21:10 -02:00
s2255 [media] media: videobuf2: Move timestamp to vb2_buffer 2015-12-18 13:53:31 -02:00
siano [media] media_device: move allocation out of media_device_*_init 2016-02-23 07:19:39 -03:00
stk1160 [media] stk1160: Remove redundant vb2_buf payload set 2016-02-01 07:37:20 -02:00
stkwebcam [media] stk-webcam: Delete an unnecessary check before the function call "vfree" 2015-03-02 14:53:27 -03:00
tm6000 [media] include/media: split I2C headers from V4L2 core 2015-11-17 06:57:11 -02:00
ttusb-budget [media] dvb: Get rid of typedev usage for enums 2015-06-09 17:47:35 -03:00
ttusb-dec [media] ttusb-dec: constify ttusbdecfe_config structure 2015-11-19 11:22:15 -02:00
usbtv [media] usbtv: correctly handling failed allocation 2016-02-01 07:42:00 -02:00
usbvision [media] usbvision: revert commit 588afcc1 2016-04-20 15:58:54 -03:00
uvc [media] UVC: Add support for R200 depth camera 2016-03-03 06:49:20 -03:00
zr364xx [media] usb drivers: use BUG_ON() instead of if () BUG 2015-06-09 18:30:09 -03:00
Kconfig [media] tlg2300: move to staging in preparation for removal 2014-12-16 23:21:43 -02:00
Makefile [media] tlg2300: move to staging in preparation for removal 2014-12-16 23:21:43 -02:00