public inbox for linux-media@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] staging: atomisp: fix heap buffer overflow in framebuffer conversion
@ 2026-02-10 15:35 Soufiane via B4 Relay
  0 siblings, 0 replies; only message in thread
From: Soufiane via B4 Relay @ 2026-02-10 15:35 UTC (permalink / raw)
  To: andy, hansg, mchehab, sakari.ailus
  Cc: gregkh, linux-media, linux-staging, Soufiane

From: Soufiane <soufianeda@tutanota.com>

Validate sizeimage against the allocated frame buffer size before
hmm_store() to prevent out-of-bounds write.

Signed-off-by: Soufiane <soufianeda@tutanota.com>
---
Changes in v2:
- Resend with all recipients (v1 only reached sakari and linux-staging)
- Link to v1: https://lore.kernel.org/r/20260210-atomisp-fix-v1-1-024429cbff31@tutanota.com
---
 drivers/staging/media/atomisp/pci/atomisp_cmd.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
index 3a4eb4f6d3be..ca7ffc7855ac 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
@@ -3326,6 +3326,11 @@ atomisp_v4l2_framebuffer_to_css_frame(const struct v4l2_framebuffer *arg,
 		goto err;
 	}
 
+	if (arg->fmt.sizeimage > res->data_bytes) {
+		ret = -EINVAL;
+		goto err;
+	}
+
 	tmp_buf = vmalloc(arg->fmt.sizeimage);
 	if (!tmp_buf) {
 		ret = -ENOMEM;

---
base-commit: 72c395024dac5e215136cbff793455f065603b06
change-id: 20260210-atomisp-fix-8e083f753688

Best regards,
-- 
Soufiane <soufianeda@tutanota.com>



^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2026-02-10 15:35 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-10 15:35 [PATCH v2] staging: atomisp: fix heap buffer overflow in framebuffer conversion Soufiane via B4 Relay

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox