linux/drivers/media/usb
Benoit Sevens 575a562f7a media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
commit ecf2b43018 upstream.

This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.

Fixes: c0efd23292 ("V4L/DVB (8145a): USB Video Class driver")
Signed-off-by: Benoit Sevens <bsevens@google.com>
Cc: stable@vger.kernel.org
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-11-14 13:19:39 +01:00
..
airspy media: airspy: fix memory leak in airspy probe 2022-08-30 07:31:42 +02:00
as102 media: usb: as102: drop as102_dev NULL check 2023-06-09 16:07:30 +01:00
au0828 media: mc: Make media_get_pad_index() use pad type flag 2023-05-25 16:21:22 +02:00
b2c2 media: flexcop-usb: fix sanity check of bNumEndpoints 2024-06-12 11:12:42 +02:00
cx231xx media: cx231xx: fix a memleak in cx231xx_init_isoc 2024-01-25 15:35:34 -08:00
dvb-usb media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()" 2024-08-19 06:04:31 +02:00
dvb-usb-v2 media: dvb-usb-v2: af9035: fix missing unlock 2023-11-20 11:59:33 +01:00
em28xx media: em28xx: annotate unchecked call to media_device_register() 2024-03-26 18:19:45 -04:00
go7007 media: go7007: fix a memleak in go7007_load_encoder 2024-03-26 18:19:53 -04:00
gspca media: gspca: cpia1: shift-out-of-bounds in set_flicker 2023-11-28 17:19:46 +00:00
hackrf media: Kconfig: cleanup VIDEO_DEV dependencies 2022-03-18 05:58:35 +01:00
hdpvr media: hdpvr: fix error value returns in hdpvr_read 2022-06-27 09:02:50 +01:00
msi2500 media: usb/msi2500: fix repeated words in comments 2022-09-24 08:46:38 +02:00
pvrusb2 media: pvrusb2: fix uaf in pvr2_context_set_notify 2024-03-26 18:19:53 -04:00
pwc media: usb: pwc-uncompress: Use flex array destination for memcpy() 2022-12-07 17:58:46 +01:00
s2255 media: s2255: Use refcount_t instead of atomic_t for num_channels 2024-07-11 12:49:07 +02:00
siano drivers: usb: smsusb: fix error handling code in smsusb_init_device 2023-07-19 12:57:47 +02:00
stk1160 media: stk1160: fix bounds checking in stk1160_copy_video() 2024-06-12 11:12:40 +02:00
ttusb-budget media: dvb-ttusb-budget: cleanup printk logic 2020-09-03 11:15:47 +02:00
ttusb-dec media: ttusb-dec: remove unnecessary (void*) conversions 2023-07-19 12:57:47 +02:00
usbtv media: usbtv: Remove useless locks in usbtv_video_free() 2024-10-10 11:57:19 +02:00
uvc media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format 2024-11-14 13:19:39 +01:00
Kconfig media: tm6000: deprecate this driver 2022-08-29 16:43:00 +02:00
Makefile media: tm6000: deprecate this driver 2022-08-29 16:43:00 +02:00