media: uvcvideo: Fix OOB read
authorRicardo Ribalda <ribalda@chromium.org>
Thu, 20 Jul 2023 17:46:54 +0000 (17:46 +0000)
committerHans Verkuil <hverkuil-cisco@xs4all.nl>
Thu, 14 Sep 2023 21:31:55 +0000 (23:31 +0200)
commit41ebaa5e0eebea4c3bac96b72f9f8ae0d77c0bdb
tree394eed45f5f67ea549c1a87ff3c5b95bbefc79d6
parent861ab817b5ebe5e34bfbf01943b86ded6bba97b3
media: uvcvideo: Fix OOB read

If the index provided by the user is bigger than the mask size, we might do
an out of bound read.

CC: stable@kernel.org
Fixes: 40140eda661e ("media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU")
Reported-by: Zubin Mithra <zsm@chromium.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
drivers/media/usb/uvc/uvc_ctrl.c