Unverified Commit e32ad9da authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9440 fix CVE-2024-38621 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liao Chen <liaochen4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/DAEYRVL2WN2PXENCKWOVXQQTLK3P4XTR/ 
media: stk1160: fix bounds checking in stk1160_copy_video()

Dan Carpenter (1):
  media: stk1160: fix bounds checking in stk1160_copy_video()


-- 
2.34.1
 
https://gitee.com/openeuler/kernel/issues/IA85JQ 
 
Link:https://gitee.com/openeuler/kernel/pulls/9440

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents c98c085d 782e7c77

drivers/media/usb/stk1160/stk1160-video.c

+15 −5
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ void stk1160_buffer_done(struct stk1160 *dev) 
static inline

void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)

{

	int linesdone, lineoff, lencopy;

	int linesdone, lineoff, lencopy, offset;

	int bytesperline = dev->width * 2;

	struct stk1160_buffer *buf = dev->isoc_ctl.buf;

	u8 *dst = buf->mem;
@@ -140,8 +140,13 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len) 
	 * Check if we have enough space left in the buffer.

	 * In that case, we force loop exit after copy.

	 */

	if (lencopy > buf->bytesused - buf->length) {

		lencopy = buf->bytesused - buf->length;

	offset = dst - (u8 *)buf->mem;

	if (offset > buf->length) {

		dev_warn_ratelimited(dev->dev, "out of bounds offset\n");

		return;

	}

	if (lencopy > buf->length - offset) {

		lencopy = buf->length - offset;

		remain = lencopy;

	}
@@ -183,8 +188,13 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len) 
		 * Check if we have enough space left in the buffer.

		 * In that case, we force loop exit after copy.

		 */

		if (lencopy > buf->bytesused - buf->length) {

			lencopy = buf->bytesused - buf->length;

		offset = dst - (u8 *)buf->mem;

		if (offset > buf->length) {

			dev_warn_ratelimited(dev->dev, "offset out of bounds\n");

			return;

		}

		if (lencopy > buf->length - offset) {

			lencopy = buf->length - offset;

			remain = lencopy;

		}