mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-22 09:54:43 +07:00
47bb117911
When initially testing the Camera Terminal Descriptor wTerminalType field (buffer[4]), no mask is used. Later in the function, the MSB is overloaded to store the descriptor subtype, and so a mask of 0x7fff is used to check the type. If a descriptor is specially crafted to set this overloaded bit in the original wTerminalType field, the initial type check will fail (falling through, without adjusting the buffer size), but the later type checks will pass, assuming the buffer has been made suitably large, causing an overflow. Avoid this problem by checking for the MSB in the wTerminalType field. If the bit is set, assume the descriptor is bad, and abort parsing it. Originally reported here: https://groups.google.com/forum/#!topic/syzkaller/Ot1fOE6v1d8 A similar (non-compiling) patch was provided at that time. Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Alistair Strachan <astrachan@google.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
||
|---|---|---|
| .. | ||
| airspy | ||
| as102 | ||
| au0828 | ||
| b2c2 | ||
| cpia2 | ||
| cx231xx | ||
| dvb-usb | ||
| dvb-usb-v2 | ||
| em28xx | ||
| go7007 | ||
| gspca | ||
| hackrf | ||
| hdpvr | ||
| msi2500 | ||
| pulse8-cec | ||
| pvrusb2 | ||
| pwc | ||
| rainshadow-cec | ||
| s2255 | ||
| siano | ||
| stk1160 | ||
| stkwebcam | ||
| tm6000 | ||
| ttusb-budget | ||
| ttusb-dec | ||
| usbtv | ||
| usbvision | ||
| uvc | ||
| zr364xx | ||
| Kconfig | ||
| Makefile | ||