From: Benoit Sevens <bsevens@google.com>
To: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: linux-media@vger.kernel.org, gregkh@linuxfoundation.org,
Benoit Sevens <bsevens@google.com>,
stable@kernel.org
Subject: [PATCH v1 1/2] media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
Date: Thu, 7 Nov 2024 14:22:02 +0000 [thread overview]
Message-ID: <20241107142204.1182969-2-bsevens@google.com> (raw)
In-Reply-To: <20241107142204.1182969-1-bsevens@google.com>
This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.
Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver")
Signed-off-by: Benoit Sevens <bsevens@google.com>
---
drivers/media/usb/uvc/uvc_driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index 0fac689c6350..13db0026dc1a 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -371,7 +371,7 @@ static int uvc_parse_format(struct uvc_device *dev,
* Parse the frame descriptors. Only uncompressed, MJPEG and frame
* based formats have frame descriptors.
*/
- while (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
+ while (ftype && buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
buffer[2] == ftype) {
unsigned int maxIntervalIndex;
--
2.47.0.277.g8800431eea-goog
next prev parent reply other threads:[~2024-11-07 14:22 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-11-07 14:22 [PATCH v1 0/2] Skip parsing frames of type UVC_VS_UNDEFINED in Benoit Sevens
2024-11-07 14:22 ` Benoit Sevens [this message]
2024-11-07 14:53 ` [PATCH v1 1/2] media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format Greg KH
2024-11-07 15:04 ` Laurent Pinchart
2024-11-08 0:04 ` Laurent Pinchart
2024-11-07 14:22 ` [PATCH v1 2/2] media: uvcvideo: Refactor frame parsing code into a uvc_parse_frame function Benoit Sevens
2024-11-07 16:45 ` Laurent Pinchart
2024-11-07 18:58 ` Benoît Sevens
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241107142204.1182969-2-bsevens@google.com \
--to=bsevens@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-media@vger.kernel.org \
--cc=stable@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox