[bug report] [media] cx231xx: Added support for Carraera, Shelby, RDx_253S and VIDEO_GRABBER

[bug report] [media] cx231xx: Added support for Carraera, Shelby, RDx_253S and VIDEO_GRABBER

[Dan Carpenter]

Hello Media Developers,

Commit 64fbf4445526 ("[media] cx231xx: Added support for Carraera,
Shelby, RDx_253S and VIDEO_GRABBER") from Jul 6, 2010 (linux-next),
leads to the following Smatch static checker warning:

	drivers/media/usb/cx231xx/cx231xx-417.c:1354 cx231xx_bulk_copy()
	warn: buffer 'buffer' too small user_len=0-u32max for 3 byte copy

drivers/media/usb/cx231xx/cx231xx-417.c
    1341 static int cx231xx_bulk_copy(struct cx231xx *dev, struct urb *urb)
    1342 {
    1343         struct cx231xx_dmaqueue *dma_q = urb->context;
    1344         unsigned char *p_buffer, *buffer;
    1345         u32 buffer_size = 0;
    1346 
    1347         p_buffer = urb->transfer_buffer;
    1348         buffer_size = urb->actual_length;

Smatch and ChatGPT want an:

	if (buffer_size < 3)
		return -ESOMETHING;

    1349 
    1350         buffer = kmalloc(buffer_size, GFP_ATOMIC);
    1351         if (!buffer)
    1352                 return -ENOMEM;
    1353 
--> 1354         memcpy(buffer, dma_q->ps_head, 3);

Otherwise it leads to a crash.

    1355         memcpy(buffer+3, p_buffer, buffer_size-3);
    1356         memcpy(dma_q->ps_head, p_buffer+buffer_size-3, 3);
    1357 
    1358         p_buffer = buffer;
    1359         buffer_filled(p_buffer, buffer_size, urb, dma_q);
    1360 
    1361         kfree(buffer);
    1362         return 0;
    1363 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter