media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer

Browse source

In af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach af9035_i2c_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd76
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

...

This commit is contained in:

Zhang Shurong 2023-07-06 00:06:54 +08:00 • committed by Hans Verkuil

parent d5b3214a92

commit 7bf744f2de

1 changed files with 5 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

9

drivers/media/usb/dvb-usb-v2/af9035.c

View file