Commit 7dec44d5 authored Feb 14, 2017 by Robb Glasser Committed by Dennis Cagle Jun 21, 2018

Prevent heap overflow in uvc driver



The size of uvc_control_mapping is user controlled leading to a
potential heap overflow in the uvc driver. This adds a check to verify
the user provided size fits within the bounds of the defined buffer
size.

Bug: 33300353
Change-Id: If29c1b396633b6137966a12e38f6fd1841b045bd
Signed-off-by: Robb Glasser <rglasser@google.com>
Git-repo: https://android.googlesource.com/kernel/msm


Git-commit: 8bc3ec72a02052187397d0de1a7b8bbe7340451c
Signed-off-by: Dennis Cagle <dcagle@codeaurora.org>

parent cb57e6b4

drivers/media/usb/uvc/uvc_ctrl.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1992,6 +1992,9 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
		if (!found)
		return -ENOENT;

		if (ctrl->info.size < mapping->size)
		return -EINVAL;

		if (mutex_lock_interruptible(&chain->ctrl_mutex))
		return -ERESTARTSYS;