lkml.org 
[lkml]   [2017]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 055/134] [media] zr364xx: enforce minimum size when reading header
    3.16.47-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alyssa Milburn <amilburn@zall.org>

    commit ee0fe833d96793853335844b6d99fb76bd12cbeb upstream.

    This code copies actual_length-128 bytes from the header, which will
    underflow if the received buffer is too small.

    Signed-off-by: Alyssa Milburn <amilburn@zall.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/media/usb/zr364xx/zr364xx.c | 8 ++++++++
    1 file changed, 8 insertions(+)

    --- a/drivers/media/usb/zr364xx/zr364xx.c
    +++ b/drivers/media/usb/zr364xx/zr364xx.c
    @@ -605,6 +605,14 @@ static int zr364xx_read_video_callback(s
    ptr = pdest = frm->lpvbits;

    if (frm->ulState == ZR364XX_READ_IDLE) {
    + if (purb->actual_length < 128) {
    + /* header incomplete */
    + dev_info(&cam->udev->dev,
    + "%s: buffer (%d bytes) too small to hold jpeg header. Discarding.\n",
    + __func__, purb->actual_length);
    + return -EINVAL;
    + }
    +
    frm->ulState = ZR364XX_READ_FRAME;
    frm->cur_size = 0;

    \
     
     \ /
      Last update: 2017-08-18 15:46    [W:2.464 / U:0.104 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site