Skip to content

media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()

Lucas Zampieri requested to merge lzampier/centos-stream-9:lzampier_0001 into main

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1958655
Upstream-status: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git

commit 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
Author: Dan Carpenter dan.carpenter@oracle.com
Date: Mon Jun 7 17:23:48 2021 +0200
media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()

The bounds checking in avc_ca_pmt() is not strict enough.  It should  
be checking "read_pos + 4" because it's reading 5 bytes.  If the  
"es_info_length" is non-zero then it reads a 6th byte so there needs to  
be an additional check for that.  

I also added checks for the "write_pos".  I don't think these are  
required because "read_pos" and "write_pos" are tied together so  
checking one ought to be enough.  But they make the code easier to  
understand for me.  The check on write_pos is:  

	if (write_pos + 4 >= sizeof(c->operand) - 4) {  

The first "+ 4" is because we're writing 5 bytes and the last " - 4"  
is to leave space for the CRC.  

The other problem is that "length" can be invalid.  It comes from  
"data_length" in fdtv_ca_pmt().  

Cc: stable@vger.kernel.org  
Reported-by: Luo Likang <luolikang@nsfocus.com>  
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>  
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>  
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

Signed-off-by: Lucas Zampieri lzampier@redhat.com

Merge request reports