Messages in this thread Patch in this message | | | From | Ricardo Ribalda <> | Date | Thu, 20 Jul 2023 17:46:54 +0000 | Subject | [PATCH v2] media: uvcvideo: Fix OOB read |
| |
If the index provided by the user is bigger than the mask size, we might do an out of bound read.
CC: stable@kernel.org Fixes: 40140eda661e ("media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU") Reported-by: Zubin Mithra <zsm@chromium.org> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> --- Avoid reading index >= 31 --- Changes in v2: - Use BITS_PER_TYPE instead of 32 (thanks Sergey). - Add Reported-by tag. - Link to v1: https://lore.kernel.org/r/20230717-uvc-oob-v1-1-f5b9b4aba3b4@chromium.org --- drivers/media/usb/uvc/uvc_ctrl.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 5e9d3da862dd..e59a463c2761 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1402,6 +1402,9 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain, query_menu->id = id; query_menu->index = index; + if (index >= BITS_PER_TYPE(mapping->menu_mask)) + return -EINVAL; + ret = mutex_lock_interruptible(&chain->ctrl_mutex); if (ret < 0) return -ERESTARTSYS; --- base-commit: fdf0eaf11452d72945af31804e2a1048ee1b574c change-id: 20230717-uvc-oob-4b0148a00417 Best regards, -- Ricardo Ribalda <ribalda@chromium.org>
| |