diff options
| author | Alyssa Milburn <amilburn@zall.org> | 2017-04-01 17:34:08 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-05-25 13:44:42 (GMT) |
| commit | 64579fcc57fd00e1e9f021eba90d01d3371dc6b7 (patch) | |
| tree | 39d8f77a7471def7776388d91bdf82d61b507c02 /drivers/media | |
| parent | 466b45af50fd27754dff2982c65396c5ca9d461c (diff) | |
| download | linux-64579fcc57fd00e1e9f021eba90d01d3371dc6b7.tar.xz | |
zr364xx: enforce minimum size when reading header
commit ee0fe833d96793853335844b6d99fb76bd12cbeb upstream.
This code copies actual_length-128 bytes from the header, which will
underflow if the received buffer is too small.
Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/usb/zr364xx/zr364xx.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c index cc128db..e3735bf 100644 --- a/drivers/media/usb/zr364xx/zr364xx.c +++ b/drivers/media/usb/zr364xx/zr364xx.c @@ -604,6 +604,14 @@ static int zr364xx_read_video_callback(struct zr364xx_camera *cam, ptr = pdest = frm->lpvbits; if (frm->ulState == ZR364XX_READ_IDLE) { + if (purb->actual_length < 128) { + /* header incomplete */ + dev_info(&cam->udev->dev, + "%s: buffer (%d bytes) too small to hold jpeg header. Discarding.\n", + __func__, purb->actual_length); + return -EINVAL; + } + frm->ulState = ZR364XX_READ_FRAME; frm->cur_size = 0; |