diff options
| author |   Ricardo Ribalda <ribalda@chromium.org> | 2023-07-20 17:46:54 +0000 |
|---|---|---|
| committer |   Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2023-09-14 23:31:55 +0200 |
| commit | 41ebaa5e0eebea4c3bac96b72f9f8ae0d77c0bdb (patch) | |
| tree | 394eed45f5f67ea549c1a87ff3c5b95bbefc79d6 /drivers/media/usb/uvc/uvc_ctrl.c | |
| parent | media: bt8xx: bttv_risc_packed(): remove field checks (diff) | |
| download | wireguard-linux-41ebaa5e0eebea4c3bac96b72f9f8ae0d77c0bdb.tar.xz wireguard-linux-41ebaa5e0eebea4c3bac96b72f9f8ae0d77c0bdb.zip | |
media: uvcvideo: Fix OOB read
If the index provided by the user is bigger than the mask size, we might do
an out of bound read.
CC: stable@kernel.org
Fixes: 40140eda661e ("media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU")
Reported-by: Zubin Mithra <zsm@chromium.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Diffstat (limited to 'drivers/media/usb/uvc/uvc_ctrl.c')
| -rw-r--r-- | drivers/media/usb/uvc/uvc_ctrl.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 5e9d3da862dd..e59a463c2761 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1402,6 +1402,9 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain, query_menu->id = id; query_menu->index = index; + if (index >= BITS_PER_TYPE(mapping->menu_mask)) + return -EINVAL; + ret = mutex_lock_interruptible(&chain->ctrl_mutex); if (ret < 0) return -ERESTARTSYS; |