From 12ebdbcdf7dac84e57b10f7451ad97e20fa1603b Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hans.verkuil@cisco.com>
Date: Tue, 2 Oct 2012 02:47:58 -0300
Subject: [PATCH] --- yaml --- r: 333850 b: refs/heads/master c:
 1b8b10cc7e6bd9bf017c58e32b1e7f632e23850d h: refs/heads/master v: v3

---
 [refs]                                     | 2 +-
 trunk/drivers/media/v4l2-core/v4l2-ioctl.c | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index ca74307f8a5e..f84caa6d8f6a 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8a18382c3196978164f0f6290aac98f2f6f43c00
+refs/heads/master: 1b8b10cc7e6bd9bf017c58e32b1e7f632e23850d
diff --git a/trunk/drivers/media/v4l2-core/v4l2-ioctl.c b/trunk/drivers/media/v4l2-core/v4l2-ioctl.c
index 16205d9bddfc..11874c170cbe 100644
--- a/trunk/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/trunk/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -2212,6 +2212,10 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
 		struct v4l2_subdev_edid *edid = parg;
 
 		if (edid->blocks) {
+			if (edid->blocks > 256) {
+				ret = -EINVAL;
+				break;
+			}
 			*user_ptr = (void __user *)edid->edid;
 			*kernel_ptr = (void *)&edid->edid;
 			*array_size = edid->blocks * 128;