media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()

In az6027_i2c_xfer, msg is controlled by user. When msg[i].buf is null,
commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in
az6027_i2c_xfer()") fix the null-ptr-deref bug when msg[i].addr is 0x99.
However, null-ptr-deref also happens when msg[i].addr is 0xd0 and 0xc0.
We add check on msg[i].len to prevent null-ptr-deref.

Link: https://lore.kernel.org/linux-media/20230310165604.3093483-1-harperchen1110@gmail.com
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c
index 7d78ee09be5e1dc40d813777d5e26e2abeb8aba3..a31c6f82f4e90fbcd08bc600ada4948180a9970f 100644 (file)
--- a/drivers/media/usb/dvb-usb/az6027.c
+++ b/drivers/media/usb/dvb-usb/az6027.c
@@ -988,6 +988,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
                        /* write/read request */
                        if (i + 1 < num && (msg[i + 1].flags & I2C_M_RD)) {
                                req = 0xB9;
+                               if (msg[i].len < 1) {
+                                       i = -EOPNOTSUPP;
+                                       break;
+                               }
                                index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff));
                                value = msg[i].addr + (msg[i].len << 8);
                                length = msg[i + 1].len + 6;
@@ -1001,6 +1005,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
 
                                /* demod 16bit addr */
                                req = 0xBD;
+                               if (msg[i].len < 1) {
+                                       i = -EOPNOTSUPP;
+                                       break;
+                               }
                                index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff));
                                value = msg[i].addr + (2 << 8);
                                length = msg[i].len - 2;
@@ -1026,6 +1034,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
                        } else {
 
                                req = 0xBD;
+                               if (msg[i].len < 1) {
+                                       i = -EOPNOTSUPP;
+                                       break;
+                               }
                                index = msg[i].buf[0] & 0x00FF;
                                value = msg[i].addr + (1 << 8);
                                length = msg[i].len - 1;