diff options
| author | Alyssa Milburn <amilburn@zall.org> | 2017-04-01 19:34:08 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2017-04-18 17:57:29 +0200 |
| commit | ee0fe833d96793853335844b6d99fb76bd12cbeb (patch) | |
| tree | 9269034ee5ce117cbb6c6119226320e28d9cbf6a | |
| parent | [media] digitv: limit messages to buffer size (diff) | |
| download | linux-ee0fe833d96793853335844b6d99fb76bd12cbeb.tar.xz linux-ee0fe833d96793853335844b6d99fb76bd12cbeb.zip | |
[media] zr364xx: enforce minimum size when reading header
This code copies actual_length-128 bytes from the header, which will
underflow if the received buffer is too small.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| -rw-r--r-- | drivers/media/usb/zr364xx/zr364xx.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c index f2d6fc03dda0..efdcd5bd6a4c 100644 --- a/drivers/media/usb/zr364xx/zr364xx.c +++ b/drivers/media/usb/zr364xx/zr364xx.c @@ -600,6 +600,14 @@ static int zr364xx_read_video_callback(struct zr364xx_camera *cam, ptr = pdest = frm->lpvbits; if (frm->ulState == ZR364XX_READ_IDLE) { + if (purb->actual_length < 128) { + /* header incomplete */ + dev_info(&cam->udev->dev, + "%s: buffer (%d bytes) too small to hold jpeg header. Discarding.\n", + __func__, purb->actual_length); + return -EINVAL; + } + frm->ulState = ZR364XX_READ_FRAME; frm->cur_size = 0; |