From: Jeongjun Park <aha310510@gmail.com>
To: mchehab@kernel.org
Cc: christophe.jaillet@wanadoo.fr, hverkuil@xs4all.nl,
harperchen1110@gmail.com, linux-media@vger.kernel.org,
linux-kernel@vger.kernel.org, Jeongjun Park <aha310510@gmail.com>
Subject: [PATCH] media: dvb-usb: az6027: fix out-of-bounds in az6027_i2c_xfer()
Date: Mon, 21 Apr 2025 20:50:45 +0900 [thread overview]
Message-ID: <20250421115045.81394-1-aha310510@gmail.com> (raw)
Missing maximum size check on msg[i].len causes out-of-bounds vuln for u8 *data.
Therefore, we need to add proper range checking to prevent this vuln.
Fixes: 858e97d7956d ("media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
---
drivers/media/usb/dvb-usb/az6027.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c
index 056935d3cbd6..f9bd8a4c1577 100644
--- a/drivers/media/usb/dvb-usb/az6027.c
+++ b/drivers/media/usb/dvb-usb/az6027.c
@@ -988,7 +988,7 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
/* write/read request */
if (i + 1 < num && (msg[i + 1].flags & I2C_M_RD)) {
req = 0xB9;
- if (msg[i].len < 1) {
+ if (msg[i].len < 1 || msg[i + 1].len + 5 > sizeof(data)) {
i = -EOPNOTSUPP;
break;
}
@@ -1005,7 +1005,7 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
/* demod 16bit addr */
req = 0xBD;
- if (msg[i].len < 1) {
+ if (msg[i].len < 1 || msg[i].len - 2 > sizeof(data)) {
i = -EOPNOTSUPP;
break;
}
@@ -1034,7 +1034,7 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
} else {
req = 0xBD;
- if (msg[i].len < 1) {
+ if (msg[i].len < 1 || msg[i].len - 1 > sizeof(data)) {
i = -EOPNOTSUPP;
break;
}
--
reply other threads:[~2025-04-21 11:50 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250421115045.81394-1-aha310510@gmail.com \
--to=aha310510@gmail.com \
--cc=christophe.jaillet@wanadoo.fr \
--cc=harperchen1110@gmail.com \
--cc=hverkuil@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox