| From 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Mon, 7 Jun 2021 17:23:48 +0200 |
| Subject: media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| commit 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e upstream. |
| |
| The bounds checking in avc_ca_pmt() is not strict enough. It should |
| be checking "read_pos + 4" because it's reading 5 bytes. If the |
| "es_info_length" is non-zero then it reads a 6th byte so there needs to |
| be an additional check for that. |
| |
| I also added checks for the "write_pos". I don't think these are |
| required because "read_pos" and "write_pos" are tied together so |
| checking one ought to be enough. But they make the code easier to |
| understand for me. The check on write_pos is: |
| |
| if (write_pos + 4 >= sizeof(c->operand) - 4) { |
| |
| The first "+ 4" is because we're writing 5 bytes and the last " - 4" |
| is to leave space for the CRC. |
| |
| The other problem is that "length" can be invalid. It comes from |
| "data_length" in fdtv_ca_pmt(). |
| |
| Cc: stable@vger.kernel.org |
| Reported-by: Luo Likang <luolikang@nsfocus.com> |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/media/firewire/firedtv-avc.c | 14 +++++++++++--- |
| drivers/media/firewire/firedtv-ci.c | 2 ++ |
| 2 files changed, 13 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/media/firewire/firedtv-avc.c |
| +++ b/drivers/media/firewire/firedtv-avc.c |
| @@ -1169,7 +1169,11 @@ int avc_ca_pmt(struct firedtv *fdtv, cha |
| read_pos += program_info_length; |
| write_pos += program_info_length; |
| } |
| - while (read_pos < length) { |
| + while (read_pos + 4 < length) { |
| + if (write_pos + 4 >= sizeof(c->operand) - 4) { |
| + ret = -EINVAL; |
| + goto out; |
| + } |
| c->operand[write_pos++] = msg[read_pos++]; |
| c->operand[write_pos++] = msg[read_pos++]; |
| c->operand[write_pos++] = msg[read_pos++]; |
| @@ -1181,13 +1185,17 @@ int avc_ca_pmt(struct firedtv *fdtv, cha |
| c->operand[write_pos++] = es_info_length >> 8; |
| c->operand[write_pos++] = es_info_length & 0xff; |
| if (es_info_length > 0) { |
| + if (read_pos >= length) { |
| + ret = -EINVAL; |
| + goto out; |
| + } |
| pmt_cmd_id = msg[read_pos++]; |
| if (pmt_cmd_id != 1 && pmt_cmd_id != 4) |
| dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n", |
| pmt_cmd_id); |
| |
| - if (es_info_length > sizeof(c->operand) - 4 - |
| - write_pos) { |
| + if (es_info_length > sizeof(c->operand) - 4 - write_pos || |
| + es_info_length > length - read_pos) { |
| ret = -EINVAL; |
| goto out; |
| } |
| --- a/drivers/media/firewire/firedtv-ci.c |
| +++ b/drivers/media/firewire/firedtv-ci.c |
| @@ -138,6 +138,8 @@ static int fdtv_ca_pmt(struct firedtv *f |
| } else { |
| data_length = msg->msg[3]; |
| } |
| + if (data_length > sizeof(msg->msg) - data_pos) |
| + return -EINVAL; |
| |
| return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length); |
| } |