Commit eacb975b authored Mar 13, 2017 by Johan Hovold Committed by Mauro Carvalho Chehab Apr 10, 2017

[media] usbvision: fix NULL-deref at probe



Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Fixes: 2a9f8b5d ("V4L/DVB (5206): Usbvision: set alternate interface
modification")

Cc: stable <stable@vger.kernel.org>     # 2.6.21
Cc: Thierry MERLE <thierry.merle@free.fr>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

parent d5823511

drivers/media/usb/usbvision/usbvision-video.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -1501,7 +1501,14 @@ static int usbvision_probe(struct usb_interface *intf,
		}

		for (i = 0; i < usbvision->num_alt; i++) {
		u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[1].desc.
		u16 tmp;

		if (uif->altsetting[i].desc.bNumEndpoints < 2) {
		ret = -ENODEV;
		goto err_pkt;
		}

		tmp = le16_to_cpu(uif->altsetting[i].endpoint[1].desc.
		wMaxPacketSize);
		usbvision->alt_max_pkt_size[i] =
		(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);

Admin message