| Message ID | 20230717-uvc-oob-v1-1-f5b9b4aba3b4@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | media: uvcvideo: Fix OOB read | expand |
On (23/07/19 12:05), Ricardo Ribalda wrote: > diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c > index 5e9d3da862dd..5e3af66a2223 100644 > --- a/drivers/media/usb/uvc/uvc_ctrl.c > +++ b/drivers/media/usb/uvc/uvc_ctrl.c > @@ -1402,6 +1402,9 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain, > query_menu->id = id; > query_menu->index = index; > > + if (index >= UVC_MAX_MENU) > + return -EINVAL; We probably can just do if (index >= BITS_PER_TYPE(mapping->menu_mask)) return -EINVAL; This should be better than using a hard-coded constant or even BITS_PER_LONG (which is still a hard-coded constant). Because BITS_PER_LONG won't get us covered if one day ->menu_mask data type changes.
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 5e9d3da862dd..5e3af66a2223 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1402,6 +1402,9 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain, query_menu->id = id; query_menu->index = index; + if (index >= UVC_MAX_MENU) + return -EINVAL; + ret = mutex_lock_interruptible(&chain->ctrl_mutex); if (ret < 0) return -ERESTARTSYS; diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index 6fb0a78b1b00..139608f83499 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -101,6 +101,7 @@ struct uvc_control_info { u32 flags; }; +#define UVC_MAX_MENU 32 struct uvc_control_mapping { struct list_head list; struct list_head ev_subs;
If the index provided by the user is bigger than 32, we might do an out of bound read. CC: stable@kernel.org Fixes: 40140eda661e ("media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU") Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> --- Avoid reading index >= 31 --- drivers/media/usb/uvc/uvc_ctrl.c | 3 +++ drivers/media/usb/uvc/uvcvideo.h | 1 + 2 files changed, 4 insertions(+) --- base-commit: fdf0eaf11452d72945af31804e2a1048ee1b574c change-id: 20230717-uvc-oob-4b0148a00417 Best regards,