Dan Carpenter 2461f38384 media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() ... commit 35d2969ea3 upstream. The bounds checking in avc_ca_pmt() is not strict enough. It should be checking "read_pos + 4" because it's reading 5 bytes. If the "es_info_length" is non-zero then it reads a 6th byte so there needs to be an additional check for that. I also added checks for the "write_pos". I don't think these are required because "read_pos" and "write_pos" are tied together so checking one ought to be enough. But they make the code easier to understand for me. The check on write_pos is: if (write_pos + 4 >= sizeof(c->operand) - 4) { The first "+ 4" is because we're writing 5 bytes and the last " - 4" is to leave space for the CRC. The other problem is that "length" can be invalid. It comes from "data_length" in fdtv_ca_pmt(). Cc: stable@vger.kernel.org Reported-by: Luo Likang <luolikang@nsfocus.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-11-06 13:59:45 +01:00
..
firedtv-avc.c	media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()	2021-11-06 13:59:45 +01:00
firedtv-ci.c	media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()	2021-11-06 13:59:45 +01:00
firedtv-dvb.c
firedtv-fe.c
firedtv-fw.c
firedtv-rc.c
firedtv.h
Kconfig
Makefile