Re: XADV-2013007 Linux Kernel bt8xx Video Driver IOCTL Heap Overflow

[Dan Carpenter <dan.carpenter () oracle com>]

On Mon, Nov 18, 2013 at 01:43:47PM +0900, x90c wrote:
> [~linux/2.6.18/include/linux/videodev.h]
> ----
> struct video_window
> {
> __u32 x,y; /* Position of window */
> __u32 width,height; /* Its size */
> __u32 chromakey;
> __u32 flags;
> struct video_clip __user *clips; /* Set only */
> int clipcount;
> #define VIDEO_WINDOW_INTERLACE 1
> #define VIDEO_WINDOW_CHROMAKEY 16 /* Overlay by chromakey */
> #define VIDEO_CLIP_BITMAP -1
> /* bitmap is 1024x625, a '1' bit represents a clipped pixel */
> #define VIDEO_CLIPMAP_SIZE (128 * 625)
> };

You are looking at the wrong struct.  You should be looking at
struct v4l2_window.  clipount is unsigned in v4l2_window so the code
is ok I think...  I don't have the hardware so I can't test your PoC.

regards,
dan carpenter

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/