From 0bce298573aafb56b19f1f3ee536a846691e96e8 Mon Sep 17 00:00:00 2001
From: Arnaud Patard <apatard@mandriva.com>
Date: Mon, 25 Jan 2010 12:02:31 -0300
Subject: [PATCH] --- yaml --- r: 181603 b: refs/heads/master c:
 22c859faf5e10e7f7b04a2c643a98eeee69c1815 h: refs/heads/master i:   181601:
 edde9ab5f1b612d49d694f8e6b51cac84bd7c42e   181599:
 ac6cf28e176893151d8fc1f2d88bad66377ff8c1 v: v3

---
 [refs]                                          | 2 +-
 trunk/drivers/media/video/v4l2-compat-ioctl32.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index feaf252615c4..3444d58ad914 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 6aba72cf76d21527dc73403e4147397375c8c232
+refs/heads/master: 22c859faf5e10e7f7b04a2c643a98eeee69c1815
diff --git a/trunk/drivers/media/video/v4l2-compat-ioctl32.c b/trunk/drivers/media/video/v4l2-compat-ioctl32.c
index dc7b8c23eac0..f77f84bfe714 100644
--- a/trunk/drivers/media/video/v4l2-compat-ioctl32.c
+++ b/trunk/drivers/media/video/v4l2-compat-ioctl32.c
@@ -475,6 +475,9 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
 			return -EFAULT;
 	switch (kp->memory) {
 	case V4L2_MEMORY_MMAP:
+		if (get_user(kp->length, &up->length) ||
+			get_user(kp->m.offset, &up->m.offset))
+			return -EFAULT;
 		break;
 	case V4L2_MEMORY_USERPTR:
 		{