Rajeshwar R Shinde 1b187400f9 media: gspca: cpia1: shift-out-of-bounds in set_flicker ... [ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ] Syzkaller reported the following issue: UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too large for 32-bit type 'int' When the value of the variable "sd->params.exposure.gain" exceeds the number of bits in an integer, a shift-out-of-bounds error is reported. It is triggered because the variable "currentexp" cannot be left-shifted by more than the number of bits in an integer. In order to avoid invalid range during left-shift, the conditional expression is added. Reported-by: syzbot+e27f3dbdab04e43b9f73@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73 Signed-off-by: Rajeshwar R Shinde <coolrrsh@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-11-18 11:43:14 +01:00
..
gl860
m5602
stv06xx
autogain_functions.c
benq.c
conex.c
cpia1.c
dtcs033.c
etoms.c
finepix.c
gspca.c
gspca.h
jeilinj.c
jl2005bcd.c
jpeg.h
Kconfig
kinect.c
konica.c
Makefile
mars.c
mr97310a.c
nw80x.c
ov519.c
ov534.c
ov534_9.c
pac207.c
pac7302.c
pac7311.c
pac_common.h
se401.c
se401.h
sn9c20x.c
sn9c2028.c
sn9c2028.h
sonixb.c
sonixj.c
spca500.c
spca501.c
spca505.c
spca506.c
spca508.c
spca561.c
spca1528.c
sq905.c
sq905c.c
sq930x.c
stk014.c
stk1135.c
stk1135.h
stv0680.c
sunplus.c
t613.c
topro.c
touptek.c
tv8532.c
vc032x.c
vicam.c
w996Xcf.c
xirlink_cit.c
zc3xx-reg.h
zc3xx.c