full-disclosure - Re: XADV-2013007 Linux Kernel bt8xx Video Driver IOCTL Heap Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20131120095600.GA1475@mwanda>
Date: Wed, 20 Nov 2013 12:56:00 +0300
From: Dan Carpenter <dan.carpenter@...cle.com>
To: x90c <geinblues@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: XADV-2013007 Linux Kernel bt8xx Video Driver
 IOCTL Heap Overflow

On Mon, Nov 18, 2013 at 01:43:47PM +0900, x90c wrote:
> [~linux/2.6.18/include/linux/videodev.h]
> ----
> struct video_window
> {
> __u32 x,y; /* Position of window */
> __u32 width,height; /* Its size */
> __u32 chromakey;
> __u32 flags;
> struct video_clip __user *clips; /* Set only */
> int clipcount;
> #define VIDEO_WINDOW_INTERLACE 1
> #define VIDEO_WINDOW_CHROMAKEY 16 /* Overlay by chromakey */
> #define VIDEO_CLIP_BITMAP -1
> /* bitmap is 1024x625, a '1' bit represents a clipped pixel */
> #define VIDEO_CLIPMAP_SIZE (128 * 625)
> };

You are looking at the wrong struct.  You should be looking at
struct v4l2_window.  clipount is unsigned in v4l2_window so the code
is ok I think...  I don't have the hardware so I can't test your PoC.

regards,
dan carpenter

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/