[PATCH] media: dvb-frontends: dib7090: fix null-ptr-deref in dib7090_tuner_xfer()

[PATCH] media: dvb-frontends: dib7090: fix null-ptr-deref in dib7090_tuner_xfer()

[jinyaoguo]

From: jinyaoguo <guo846@purdue.edu>

In dib7090_tuner_xfer, msg is controlled by user. When msg[0].buf is null and
msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing
msg[0].buf[0] without sanity check, null pointer deref would happen. We add
check on msg[0].len to prevent crash. Similar issue occurs when access
msg[1].buf[0] and msg[1].buf[1].

Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

Signed-off-by: Alex Guo <alexguo1023@gmail.com>
---
 drivers/media/dvb-frontends/dib7000p.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
index b40daf242046..46753d2ae212 100644
--- a/drivers/media/dvb-frontends/dib7000p.c
+++ b/drivers/media/dvb-frontends/dib7000p.c
@@ -2270,6 +2270,8 @@ static int dib7090_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msg[]
 {
 	struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
 
+	if (msg[0].len < 1)
+		return -EOPNOTSUPP;
 	u16 apb_address = 0, word;
 	int i = 0;
 	switch (msg[0].buf[0]) {
@@ -2360,11 +2362,15 @@ static int dib7090_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msg[]
 	case 0x1d:
 		i = ((dib7000p_read_word(state, 72) >> 12) & 0x3);
 		word = dib7000p_read_word(state, 384 + i);
+		if (msg[1].len < 2)
+			return -EOPNOTSUPP;
 		msg[1].buf[0] = (word >> 8) & 0xff;
 		msg[1].buf[1] = (word) & 0xff;
 		return num;
 	case 0x1f:
 		if (num == 1) {	/* write */
+			if (msg[0].len < 3)
+				return -EOPNOTSUPP;
 			word = (u16) ((msg[0].buf[1] << 8) | msg[0].buf[2]);
 			word &= 0x3;
 			word = (dib7000p_read_word(state, 72) & ~(3 << 12)) | (word << 12);
-- 
2.34.1

[PATCH] media: dvb-frontends: dib7090: fix null-ptr-deref in dib7090_tuner_xfer()

[Alex Guo]

In dib7090_tuner_xfer, msg is controlled by user. When msg[0].buf is null
and msg[0].len is zero, former checks on msg[0].buf would be passed. If 
accessing msg[0].buf[0] without sanity check, null pointer deref would 
happen. We add check on msg[0].len to prevent crash. Similar issue occurs
when access msg[1].buf[0] and msg[1].buf[1].

Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

Signed-off-by: Alex Guo <alexguo1023@gmail.com>
---
 drivers/media/dvb-frontends/dib7000p.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
index b40daf242046..46753d2ae212 100644
--- a/drivers/media/dvb-frontends/dib7000p.c
+++ b/drivers/media/dvb-frontends/dib7000p.c
@@ -2270,6 +2270,8 @@ static int dib7090_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msg[]
 {
 	struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
 
+	if (msg[0].len < 1)
+		return -EOPNOTSUPP;
 	u16 apb_address = 0, word;
 	int i = 0;
 	switch (msg[0].buf[0]) {
@@ -2360,11 +2362,15 @@ static int dib7090_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msg[]
 	case 0x1d:
 		i = ((dib7000p_read_word(state, 72) >> 12) & 0x3);
 		word = dib7000p_read_word(state, 384 + i);
+		if (msg[1].len < 2)
+			return -EOPNOTSUPP;
 		msg[1].buf[0] = (word >> 8) & 0xff;
 		msg[1].buf[1] = (word) & 0xff;
 		return num;
 	case 0x1f:
 		if (num == 1) {	/* write */
+			if (msg[0].len < 3)
+				return -EOPNOTSUPP;
 			word = (u16) ((msg[0].buf[1] << 8) | msg[0].buf[2]);
 			word &= 0x3;
 			word = (dib7000p_read_word(state, 72) & ~(3 << 12)) | (word << 12);
-- 
2.34.1