[PATCH 3/3] media: au0828: require minimum isochronous packet length

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

au0828_isoc_copy() subtracts 4 from actual_length to skip the
packet header: len = urb->iso_frame_desc[i].actual_length - 4.
The existing check rejects only actual_length <= 0, so a length
of 1-3 causes len to wrap negative.  The wrapped value is then
passed to the copy helpers as an unsigned size.

Raise the minimum from > 0 to >= 5 (4-byte header plus at least
one byte of payload).

Fixes: 8b2f07952345 ("V4L/DVB (11066): au0828: add support for analog functionality in bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/media/usb/au0828/au0828-video.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c
index 3c53105f3d2b3..6cc99d1a2fbce 100644
--- a/drivers/media/usb/au0828/au0828-video.c
+++ b/drivers/media/usb/au0828/au0828-video.c
@@ -530,7 +530,7 @@ static inline int au0828_isoc_copy(struct au0828_dev *dev, struct urb *urb)
 				continue;
 		}
 
-		if (urb->iso_frame_desc[i].actual_length <= 0)
+		if (urb->iso_frame_desc[i].actual_length < 5)
 			continue;
 
 		if (urb->iso_frame_desc[i].actual_length >
-- 
2.47.3