* [PATCH v2] staging: atomisp: fix heap buffer overflow in framebuffer conversion
@ 2026-02-10 15:35 Soufiane via B4 Relay
0 siblings, 0 replies; only message in thread
From: Soufiane via B4 Relay @ 2026-02-10 15:35 UTC (permalink / raw)
To: andy, hansg, mchehab, sakari.ailus
Cc: gregkh, linux-media, linux-staging, Soufiane
From: Soufiane <soufianeda@tutanota.com>
Validate sizeimage against the allocated frame buffer size before
hmm_store() to prevent out-of-bounds write.
Signed-off-by: Soufiane <soufianeda@tutanota.com>
---
Changes in v2:
- Resend with all recipients (v1 only reached sakari and linux-staging)
- Link to v1: https://lore.kernel.org/r/20260210-atomisp-fix-v1-1-024429cbff31@tutanota.com
---
drivers/staging/media/atomisp/pci/atomisp_cmd.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
index 3a4eb4f6d3be..ca7ffc7855ac 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
@@ -3326,6 +3326,11 @@ atomisp_v4l2_framebuffer_to_css_frame(const struct v4l2_framebuffer *arg,
goto err;
}
+ if (arg->fmt.sizeimage > res->data_bytes) {
+ ret = -EINVAL;
+ goto err;
+ }
+
tmp_buf = vmalloc(arg->fmt.sizeimage);
if (!tmp_buf) {
ret = -ENOMEM;
---
base-commit: 72c395024dac5e215136cbff793455f065603b06
change-id: 20260210-atomisp-fix-8e083f753688
Best regards,
--
Soufiane <soufianeda@tutanota.com>
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-02-10 15:35 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-10 15:35 [PATCH v2] staging: atomisp: fix heap buffer overflow in framebuffer conversion Soufiane via B4 Relay
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox