Commit 7bf744f2 authored by Zhang Shurong's avatar Zhang Shurong Committed by Hans Verkuil
Browse files

media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer 



In af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach af9035_i2c_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

Signed-off-by: default avatarZhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
parent d5b3214a

drivers/media/usb/dvb-usb-v2/af9035.c

+5 −4
Original line number Diff line number Diff line
@@ -322,6 +322,8 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
			ret = -EOPNOTSUPP;

		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||

			   (msg[0].addr == state->af9033_i2c_addr[1])) {

			if (msg[0].len < 3 || msg[1].len < 1)

				return -EOPNOTSUPP;

			/* demod access via firmware interface */

			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

					msg[0].buf[2];
@@ -381,6 +383,8 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
			ret = -EOPNOTSUPP;

		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||

			   (msg[0].addr == state->af9033_i2c_addr[1])) {

			if (msg[0].len < 3)

				return -EOPNOTSUPP;

			/* demod access via firmware interface */

			u32 reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |

					msg[0].buf[2];
@@ -388,10 +392,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, 
			if (msg[0].addr == state->af9033_i2c_addr[1])

				reg |= 0x100000;



			ret = (msg[0].len >= 3) ? af9035_wr_regs(d, reg,

							         &msg[0].buf[3],

							         msg[0].len - 3)

					        : -EOPNOTSUPP;

			ret = af9035_wr_regs(d, reg, &msg[0].buf[3], msg[0].len - 3);

		} else {

			/* I2C write */

			u8 buf[MAX_XFER_SIZE];