[PATCH 1/3] media: cx231xx: validate minimum transfer length in video handlers

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

cx231xx_isoc_copy() and cx231xx_bulk_copy() both save the last 4
bytes of the transfer buffer via memcpy(dma_q->partial_buf,
p_buffer + buffer_size - 4, 4).  When the transfer length is less
than 4, the subtraction wraps to a large value and the memcpy reads
from an unintended memory offset.

Add a minimum length check to both handlers before processing.

Fixes: 64fbf4445526 ("[media] cx231xx: Added support for Carraera, Shelby, RDx_253S and VIDEO_GRABBER")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/media/usb/cx231xx/cx231xx-video.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/usb/cx231xx/cx231xx-video.c b/drivers/media/usb/cx231xx/cx231xx-video.c
index 70aa99fead278..76776cd6e5691 100644
--- a/drivers/media/usb/cx231xx/cx231xx-video.c
+++ b/drivers/media/usb/cx231xx/cx231xx-video.c
@@ -303,6 +303,9 @@ static inline int cx231xx_isoc_copy(struct cx231xx *dev, struct urb *urb)
 		buffer_size = urb->iso_frame_desc[i].actual_length;
 		bytes_parsed = 0;
 
+		if (buffer_size < 4)
+			continue;
+
 		if (dma_q->is_partial_line) {
 			/* Handle the case of a partial line */
 			sav_eav = dma_q->last_sav;
@@ -382,6 +385,9 @@ static inline int cx231xx_bulk_copy(struct cx231xx *dev, struct urb *urb)
 		buffer_size = urb->actual_length;
 		bytes_parsed = 0;
 
+		if (buffer_size < 4)
+			return 0;
+
 		if (dma_q->is_partial_line) {
 			/* Handle the case of a partial line */
 			sav_eav = dma_q->last_sav;
-- 
2.47.3