Commit a10feaf8 authored Jul 31, 2019 by Tomas Bortoli Committed by Mauro Carvalho Chehab Aug 21, 2019

media: ttusb-dec: Fix info-leak in ttusb_dec_send_command()



The function at issue does not always initialize each byte allocated
for 'b' and can therefore leak uninitialized memory to a USB device in
the call to usb_bulk_msg()

Use kzalloc() instead of kmalloc()

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by:  <syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

parent 6f005abb

drivers/media/usb/ttusb-dec/ttusb_dec.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -319,7 +319,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,

		dprintk("%s\n", __func__);

		b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
		b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
		if (!b)
		return -ENOMEM;

Admin message