diff options
| author | Zhang Shurong | 2023-07-09 00:02:20 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2023-09-23 11:11:06 +0200 |
| commit | 14b94154a72388b57221a2a73795c0ea61a95373 (patch) | |
| tree | b6a5e0ee3051cef172690918b1f9c610ba181ac3 /drivers/media/cec | |
| parent | abb6fd93e05e80668d2317fe1110bc99b05034c3 (diff) | |
media: anysee: fix null-ptr-deref in anysee_master_xfer
[ Upstream commit c30411266fd67ea3c02a05c157231654d5a3bdc9 ]
In anysee_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach anysee_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: add spaces around +]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/media/cec')
0 files changed, 0 insertions, 0 deletions