Commit e04affec authored Jul 09, 2023 by Zhang Shurong Committed by Greg Kroah-Hartman Sep 23, 2023

media: anysee: fix null-ptr-deref in anysee_master_xfer



[ Upstream commit c30411266fd67ea3c02a05c157231654d5a3bdc9 ]

In anysee_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach anysee_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: add spaces around +]
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 63d962ac

drivers/media/usb/dvb-usb-v2/anysee.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -211,7 +211,7 @@ static int anysee_master_xfer(struct i2c_adapter adap, struct i2c_msg msg,

		while (i < num) {
		if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
		if (msg[i].len > 2 \|\| msg[i+1].len > 60) {
		if (msg[i].len != 2 \|\| msg[i + 1].len > 60) {
		ret = -EOPNOTSUPP;
		break;
		}