Browse Source

linux-v4l2: avoid OOB write

v4l2_outputparm includes unused fields, defined as
	__u32		reserved[4]

Accesses to reserved[4] was out of bounds.  Fix this and simplify by
just zeroing the entire struct v4l2_streamparm instead.
Ed Maste 5 years ago
parent
commit
b9a1516254
1 changed files with 1 additions and 4 deletions
  1. 1 4
      plugins/linux-v4l2/v4l2-output.c

+ 1 - 4
plugins/linux-v4l2/v4l2-output.c

@@ -97,15 +97,12 @@ static bool try_connect(void *data, int device)
 	struct obs_video_info ovi;
 	obs_get_video_info(&ovi);
 
+	memset(&parm, 0, sizeof(parm));
 	parm.type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
 
 	parm.parm.output.capability = V4L2_CAP_TIMEPERFRAME;
 	parm.parm.output.timeperframe.numerator = ovi.fps_den;
 	parm.parm.output.timeperframe.denominator = ovi.fps_num;
-	parm.parm.output.outputmode = 0;
-	parm.parm.output.writebuffers = 0;
-	parm.parm.output.extendedmode = 0;
-	parm.parm.output.reserved[4] = 0;
 
 	if (ioctl(vcam->device, VIDIOC_S_PARM, &parm) < 0)
 		return false;