* [PATCH] media: vidtv: fix use after free in vidtv_channel_si_destroy()
@ 2020-12-03 8:42 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2020-12-03 8:42 UTC (permalink / raw)
To: Daniel W. S. Almeida, Mauro Carvalho Chehab; +Cc: linux-media, kernel-janitors
This code frees "m->si.pat" and then dereferences it on the next line.
Fixes: 039b7caed173 ("media: vidtv: add a PID entry for the NIT table")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/test-drivers/vidtv/vidtv_channel.c b/drivers/media/test-drivers/vidtv/vidtv_channel.c
index 8ad6c0744d36..7838e6272712 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_channel.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_channel.c
@@ -504,11 +504,11 @@ void vidtv_channel_si_destroy(struct vidtv_mux *m)
{
u32 i;
- vidtv_psi_pat_table_destroy(m->si.pat);
-
for (i = 0; i < m->si.pat->num_pmt; ++i)
vidtv_psi_pmt_table_destroy(m->si.pmt_secs[i]);
+ vidtv_psi_pat_table_destroy(m->si.pat);
+
kfree(m->si.pmt_secs);
vidtv_psi_sdt_table_destroy(m->si.sdt);
vidtv_psi_nit_table_destroy(m->si.nit);
--
2.29.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH] media: vidtv: fix use after free in vidtv_channel_si_destroy()
@ 2020-12-03 8:42 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2020-12-03 8:42 UTC (permalink / raw)
To: Daniel W. S. Almeida, Mauro Carvalho Chehab; +Cc: linux-media, kernel-janitors
This code frees "m->si.pat" and then dereferences it on the next line.
Fixes: 039b7caed173 ("media: vidtv: add a PID entry for the NIT table")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/test-drivers/vidtv/vidtv_channel.c b/drivers/media/test-drivers/vidtv/vidtv_channel.c
index 8ad6c0744d36..7838e6272712 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_channel.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_channel.c
@@ -504,11 +504,11 @@ void vidtv_channel_si_destroy(struct vidtv_mux *m)
{
u32 i;
- vidtv_psi_pat_table_destroy(m->si.pat);
-
for (i = 0; i < m->si.pat->num_pmt; ++i)
vidtv_psi_pmt_table_destroy(m->si.pmt_secs[i]);
+ vidtv_psi_pat_table_destroy(m->si.pat);
+
kfree(m->si.pmt_secs);
vidtv_psi_sdt_table_destroy(m->si.sdt);
vidtv_psi_nit_table_destroy(m->si.nit);
--
2.29.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] media: vidtv: fix use after free in vidtv_channel_si_destroy()
2020-12-03 8:42 ` Dan Carpenter
@ 2020-12-03 13:30 ` Daniel W. S. Almeida
-1 siblings, 0 replies; 4+ messages in thread
From: Daniel W. S. Almeida @ 2020-12-03 13:30 UTC (permalink / raw)
To: Dan Carpenter
Cc: Mauro Carvalho Chehab, linux-media@vger.kernel.org,
kernel-janitors@vger.kernel.org
Hi Dan,
> This code frees "m->si.pat" and then dereferences it on the next line.
>
> Fixes: 039b7caed173 ("media: vidtv: add a PID entry for the NIT table")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/media/test-drivers/vidtv/vidtv_channel.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
IIRC there has been a similar patch [1] that has already been accepted
by Mauro..
[1]: https://patchwork.linuxtv.org/project/linux-media/patch/20201127132832.15239-1-colin.king@canonical.com/
-- thanks
-- Daniel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-12-03 13:39 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-12-03 8:42 [PATCH] media: vidtv: fix use after free in vidtv_channel_si_destroy() Dan Carpenter
2020-12-03 8:42 ` Dan Carpenter
2020-12-03 13:30 ` Daniel W. S. Almeida
2020-12-03 13:30 ` Daniel W. S. Almeida
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.