media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 7 Jun 2021 15:23:48 +0000 (17:23 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 6 Nov 2021 13:10:09 +0000 (14:10 +0100)
commit 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e upstream.

The bounds checking in avc_ca_pmt() is not strict enough.  It should
be checking "read_pos + 4" because it's reading 5 bytes.  If the
"es_info_length" is non-zero then it reads a 6th byte so there needs to
be an additional check for that.

I also added checks for the "write_pos".  I don't think these are
required because "read_pos" and "write_pos" are tied together so
checking one ought to be enough.  But they make the code easier to
understand for me.  The check on write_pos is:

if (write_pos + 4 >= sizeof(c->operand) - 4) {

The first "+ 4" is because we're writing 5 bytes and the last " - 4"
is to leave space for the CRC.

The other problem is that "length" can be invalid.  It comes from
"data_length" in fdtv_ca_pmt().

Cc: stable@vger.kernel.org
Reported-by: Luo Likang <luolikang@nsfocus.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/media/firewire/firedtv-avc.c
drivers/media/firewire/firedtv-ci.c

index 2bf9467..71991f8 100644 (file)
@@ -1165,7 +1165,11 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
                read_pos += program_info_length;
                write_pos += program_info_length;
        }
-       while (read_pos < length) {
+       while (read_pos + 4 < length) {
+               if (write_pos + 4 >= sizeof(c->operand) - 4) {
+                       ret = -EINVAL;
+                       goto out;
+               }
                c->operand[write_pos++] = msg[read_pos++];
                c->operand[write_pos++] = msg[read_pos++];
                c->operand[write_pos++] = msg[read_pos++];
@@ -1177,13 +1181,17 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
                c->operand[write_pos++] = es_info_length >> 8;
                c->operand[write_pos++] = es_info_length & 0xff;
                if (es_info_length > 0) {
+                       if (read_pos >= length) {
+                               ret = -EINVAL;
+                               goto out;
+                       }
                        pmt_cmd_id = msg[read_pos++];
                        if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
                                dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n",
                                        pmt_cmd_id);
 
-                       if (es_info_length > sizeof(c->operand) - 4 -
-                                            write_pos) {
+                       if (es_info_length > sizeof(c->operand) - 4 - write_pos ||
+                           es_info_length > length - read_pos) {
                                ret = -EINVAL;
                                goto out;
                        }
index 9363d00..e0d57e0 100644 (file)
@@ -134,6 +134,8 @@ static int fdtv_ca_pmt(struct firedtv *fdtv, void *arg)
        } else {
                data_length = msg->msg[3];
        }
+       if (data_length > sizeof(msg->msg) - data_pos)
+               return -EINVAL;
 
        return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length);
 }