Commit 41ebaa5e authored by Ricardo Ribalda's avatar Ricardo Ribalda Committed by Hans Verkuil
Browse files

media: uvcvideo: Fix OOB read 



If the index provided by the user is bigger than the mask size, we might do
an out of bound read.

CC: stable@kernel.org
Fixes: 40140eda ("media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU")
Reported-by: default avatarZubin Mithra <zsm@chromium.org>
Signed-off-by: default avatarRicardo Ribalda <ribalda@chromium.org>
Reviewed-by: default avatarSergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
parent 861ab817

drivers/media/usb/uvc/uvc_ctrl.c

+3 −0
Original line number Diff line number Diff line
@@ -1402,6 +1402,9 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain, 
	query_menu->id = id;

	query_menu->index = index;



	if (index >= BITS_PER_TYPE(mapping->menu_mask))

		return -EINVAL;



	ret = mutex_lock_interruptible(&chain->ctrl_mutex);

	if (ret < 0)

		return -ERESTARTSYS;