[PATCH] media: ec168: fix slab-out-of-bounds in ec168_i2c_xfer

[PATCH] media: ec168: fix slab-out-of-bounds in ec168_i2c_xfer

[Deepanshu Kartikey]

The WRITE_DEMOD path in ec168_i2c_xfer() checks msg[i].len < 1
before accessing the buffer, but then reads both buf[0] (register)
and buf[1] (value). If userspace supplies a 1-byte I2C message,
the read of buf[1] goes out of bounds, triggering a KASAN
slab-out-of-bounds error.

Fix by checking msg[i].len < 2 and returning -EOPNOTSUPP if the
buffer is too short to contain both register and value bytes.

Fixes: a6dcefcc08ec ("media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()")
Reported-by: syzbot+64485d3659c4c07111b4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=64485d3659c4c07111b4
Tested-by: syzbot+64485d3659c4c07111b4@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
 drivers/media/usb/dvb-usb-v2/ec168.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c
index 973b32356b17..ebfb02826b20 100644
--- a/drivers/media/usb/dvb-usb-v2/ec168.c
+++ b/drivers/media/usb/dvb-usb-v2/ec168.c
@@ -135,7 +135,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 			}
 		} else {
 			if (msg[i].addr == ec168_ec100_config.demod_address) {
-				if (msg[i].len < 1) {
+				if (msg[i].len < 2) {
 					i = -EOPNOTSUPP;
 					break;
 				}
-- 
2.43.0