mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-28 07:13:34 +00:00
Code Issues Releases Wiki Activity

bcm2835-v4l2: Fix buffer overflow problem

Browse source 
https://github.com/raspberrypi/linux/issues/1447
port_parameter_get() failed to account for the header
(u32 id and u32 size) in the size before memcpying
the response into the response buffer, so overrunning
the provided buffer by 8 bytes.

Account for those bytes, and also a belt-and-braces
check to ensure we never copy more than *value_size
bytes into value.

Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
Signed-off-by: Michael Zoran <mzoran@crowfest.net>
Tested-by: Michael Zoran <mzoran@crowfest.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dave Stevenson 2017-03-14 08:10:40 -07:00 committed by Greg Kroah-Hartman
parent ce95e3a9c5
commit f7d51372d7
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
View file

@ -1445,7 +1445,12 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
}
ret = -rmsg->u.port_parameter_get_reply.status;
if (ret || (rmsg->u.port_parameter_get_reply.size > *value_size)) {
/* port_parameter_get_reply.size includes the header,
* whilst *value_size doesn't.
*/
rmsg->u.port_parameter_get_reply.size -= (2 * sizeof(u32));
if (ret || rmsg->u.port_parameter_get_reply.size > *value_size) {
/* Copy only as much as we have space for
* but report true size of parameter
*/