Commit 1c8af8e9 authored by Hangyu Hua's avatar Hangyu Hua Committed by Mauro Carvalho Chehab
Browse files

media: uvcvideo: Fix bit overflow in uvc_probe_video 



probe->dwMaxPayloadTransferSize is a 32bit value, but bandwidth is 16bit. This
may lead to a bit overflow.

Signed-off-by: default avatarHangyu Hua <hbh25y@gmail.com>
Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent 261f3338

drivers/media/usb/uvc/uvc_video.c

+1 −3
Original line number Diff line number Diff line
@@ -383,7 +383,6 @@ int uvc_probe_video(struct uvc_streaming *stream, 
	struct uvc_streaming_control *probe)

{

	struct uvc_streaming_control probe_min, probe_max;

	u16 bandwidth;

	unsigned int i;

	int ret;
@@ -421,8 +420,7 @@ int uvc_probe_video(struct uvc_streaming *stream, 
		if (stream->intf->num_altsetting == 1)

			break;



		bandwidth = probe->dwMaxPayloadTransferSize;

		if (bandwidth <= stream->maxpsize)

		if (probe->dwMaxPayloadTransferSize <= stream->maxpsize)

			break;



		if (stream->dev->quirks & UVC_QUIRK_PROBE_MINMAX) {