[PATCH v2] media: ttusb-dec: fix heap-buffer-overflow in ttusb_dec_process_urb_frame()

pip-izony
2025-12-22T05:47:08Z

index b4575fe89c95..0e983783e787 100644
--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
@@ -703,10 +703,19 @@ static void ttusb_dec_process_urb_frame(struct ttusb_dec *dec, u8 *b,

if (dec->packet_type == TTUSB_DEC_PACKET_PVA &&
dec->packet_length == 8) {
- dec->packet_state++;
- dec->packet_payload_length = 8 +
+ int len = 8 +
(dec->packet[6] << 8) +
dec->packet[7];
+
+ if (len > MAX_PVA_LENGTH + 4) {
+ dev_warn(&dec->udev->dev,
+ "%s: packet too long - discarding\n"