Messages in this thread | | | Date | Thu, 1 Dec 2022 13:49:38 +0000 | From | Dan Scally <> | Subject | Re: [PATCH] Prevent buffer overflow in UVC Gadget setup handler |
| |
Hello - thanks for the patch
On 01/12/2022 12:21, Szymon Heidrich wrote: > Setup function uvc_function_setup
You've written uvc_function_setup here, but the code changes uvc_function_ep0_complete.
> permits control transfer > requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), > data stage handler for OUT transfer uses memcpy to copy req->actual > bytes to uvc_event->data.data array of size 60. This may result > in an overflow of 4 bytes. > > Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Good catch
> --- > drivers/usb/gadget/function/f_uvc.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c > index 6e196e061..69c5eb3a3 100644 > --- a/drivers/usb/gadget/function/f_uvc.c > +++ b/drivers/usb/gadget/function/f_uvc.c > @@ -216,8 +216,9 @@ uvc_function_ep0_complete(struct usb_ep *ep, struct usb_request *req) > > memset(&v4l2_event, 0, sizeof(v4l2_event)); > v4l2_event.type = UVC_EVENT_DATA; > - uvc_event->data.length = req->actual; > - memcpy(&uvc_event->data.data, req->buf, req->actual); > + uvc_event->data.length = (req->actual > sizeof(uvc_event->data.data) ? > + sizeof(uvc_event->data.data) : req->actual);
There's a clamp() macro in f_uvc.c, can we use that?
> + memcpy(&uvc_event->data.data, req->buf, uvc_event->data.length); > v4l2_event_queue(&uvc->vdev, &v4l2_event); > } > }
| |