mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-25 11:55:37 +00:00
usb: gadget: uvc: Prevent buffer overflow in setup handler
commit4c92670b16
upstream. Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data array of size 60. This may result in an overflow of 4 bytes. Fixes:cdda479f15
("USB gadget: video class function driver") Cc: stable <stable@kernel.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com> Link: https://lore.kernel.org/r/20221206141301.51305-1-szymon.heidrich@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
2cd2e93227
commit
d1a92bb8d6
1 changed files with 3 additions and 2 deletions
|
@ -216,8 +216,9 @@ uvc_function_ep0_complete(struct usb_ep *ep, struct usb_request *req)
|
||||||
|
|
||||||
memset(&v4l2_event, 0, sizeof(v4l2_event));
|
memset(&v4l2_event, 0, sizeof(v4l2_event));
|
||||||
v4l2_event.type = UVC_EVENT_DATA;
|
v4l2_event.type = UVC_EVENT_DATA;
|
||||||
uvc_event->data.length = req->actual;
|
uvc_event->data.length = min_t(unsigned int, req->actual,
|
||||||
memcpy(&uvc_event->data.data, req->buf, req->actual);
|
sizeof(uvc_event->data.data));
|
||||||
|
memcpy(&uvc_event->data.data, req->buf, uvc_event->data.length);
|
||||||
v4l2_event_queue(&uvc->vdev, &v4l2_event);
|
v4l2_event_queue(&uvc->vdev, &v4l2_event);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue