media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()

Browse source

In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach dw2102_i2c_transfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 950e252cb4
("[media] dw2102: limit messages to buffer size")

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

...

This commit is contained in:

Zhang Shurong 2023-07-08 18:22:52 +08:00 • committed by Hans Verkuil

parent 1f62bf4fb8

commit 5ae544d94a

1 changed files with 24 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

24

drivers/media/usb/dvb-usb/dw2102.c

View file