Re: [PATCH] media: uvcvideo: Fix integer overflow in frame buffer size calculation
Natasha Klaus <[email protected]>
| Newsgroups | org.kernel.vger.linux-media,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 18 Aug 2026, David Laight wrote:
> I'd bet there is a requirement that width*bpp is a multiple of 8 (or even 32)?
> You definitely don't want the divide rounding down!
There is no such check. bpp is a raw descriptor byte at uvc_driver.c:405, and
wWidth is unvalidated. The rounding is pre-existing, c0efd232929c has the same
/8, so it is not a regression, but it should be DIV_ROUND_UP. uvc_driver.c:431
already uses it thirty lines below.
> > + if (bufsize > U32_MAX) {
> Should that be >= ?
No, U32_MAX itself fits.
> I'd include the bpp, width and height values in the trace.
Agreed, will do.
I am carrying this as part of a three-patch series at Ricardo's request. Will
fold in the rounding and the trace values.
Natasha