media: anysee: fix null-ptr-deref in anysee_master_xfer
stable inclusion from stable-v5.10.197 commit 4a9763d2bc4a6d6fab42555b9c0b2eefa32585ac category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96Q8P Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4a9763d2bc4a6d6fab42555b9c0b2eefa32585ac -------------------------------- [ Upstream commit c3041126 ] In anysee_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach anysee_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by:Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil: add spaces around +] Signed-off-by:
Sasha Levin <sashal@kernel.org> Signed-off-by:
sanglipeng <sanglipeng1@jd.com>
Loading
Please sign in to comment