mbox series

[v1,0/2] Skip parsing frames of type UVC_VS_UNDEFINED in

Message ID 20241107142204.1182969-1-bsevens@google.com
Headers show
Series Skip parsing frames of type UVC_VS_UNDEFINED in | expand

Message

Benoit Sevens Nov. 7, 2024, 2:22 p.m. UTC 
This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.

I am proposing a series of 2 patches. First patch is very small and
fixes the issue. The idea is to have this patch merged quickly.

The second patch refactors the code into a new uvc_parse_frame function.

I do not have the hardware setup to test this out. The second patch
should definitely be tested.

Benoit Sevens (2):
  media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in
    uvc_parse_format
  media: uvcvideo: Refactor frame parsing code into a uvc_parse_frame
    function

 drivers/media/usb/uvc/uvc_driver.c | 228 ++++++++++++++++-------------
 1 file changed, 123 insertions(+), 105 deletions(-)

Comments

gregkh@linuxfoundation.org Nov. 7, 2024, 2:53 p.m. UTC | #1 
On Thu, Nov 07, 2024 at 02:22:02PM +0000, Benoit Sevens wrote:
> This can lead to out of bounds writes since frames of this type were not
> taken into account when calculating the size of the frames buffer in
> uvc_parse_streaming.
> 
> Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver")
> Signed-off-by: Benoit Sevens <bsevens@google.com>

Cc: stable <stable@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>