Re: [PATCH v1 1/2] media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

[Laurent Pinchart <laurent.pinchart@ideasonboard.com>]

On Thu, Nov 07, 2024 at 05:04:32PM +0200, Laurent Pinchart wrote:
> Hi Benoît,
> 
> Thank you for the patch.
> 
> On Thu, Nov 07, 2024 at 02:22:02PM +0000, Benoit Sevens wrote:
> > This can lead to out of bounds writes since frames of this type were not
> > taken into account when calculating the size of the frames buffer in
> > uvc_parse_streaming.
> > 
> > Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver")
> > Signed-off-by: Benoit Sevens <bsevens@google.com>
> 
> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

Mauro, Hans, could you pick this as a fix for v6.12 ?

> > ---
> >  drivers/media/usb/uvc/uvc_driver.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
> > index 0fac689c6350..13db0026dc1a 100644
> > --- a/drivers/media/usb/uvc/uvc_driver.c
> > +++ b/drivers/media/usb/uvc/uvc_driver.c
> > @@ -371,7 +371,7 @@ static int uvc_parse_format(struct uvc_device *dev,
> >  	 * Parse the frame descriptors. Only uncompressed, MJPEG and frame
> >  	 * based formats have frame descriptors.
> >  	 */
> > -	while (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
> > +	while (ftype && buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
> >  	       buffer[2] == ftype) {
> >  		unsigned int maxIntervalIndex;
> >  

-- 
Regards,

Laurent Pinchart