[PATCH 0/3] media: USB: validate transfer lengths in URB callbacks

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

Several media USB drivers process URB transfer buffers at fixed
offsets without checking actual_length or iso_frame_desc
actual_length.  When a device delivers a short transfer, the
arithmetic on the length value wraps and the driver reads or copies
from an unintended memory offset.

This series adds minimum length checks to three drivers:

 - cx231xx video: isoc and bulk handlers need buffer_size >= 4
   before computing p_buffer + buffer_size - 4
 - cx231xx VBI: same pattern, raise threshold from > 0 to >= 4
 - au0828: isoc handler subtracts 4-byte header, raise threshold
   from > 0 to >= 5

Tristan Madani (3):
  media: cx231xx: validate minimum transfer length in video handlers
  media: cx231xx: require minimum VBI transfer length
  media: au0828: require minimum isochronous packet length

 drivers/media/usb/au0828/au0828-video.c     | 2 +-
 drivers/media/usb/cx231xx/cx231xx-vbi.c     | 2 +-
 drivers/media/usb/cx231xx/cx231xx-video.c   | 6 ++++++
 3 files changed, 8 insertions(+), 2 deletions(-)

-- 
2.39.5