linux-kernel - Re: possible bug (or not clear coding) in uvc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1706556.vixMv5JEgY@avalon>
Date:	Wed, 21 Mar 2012 13:58:05 +0100
From:	Laurent Pinchart <laurent.pinchart@...asonboard.com>
To:	Jozef Vesely <vesely@....sk>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: possible bug (or not clear coding) in uvc_v4l2.c

Hi Jozef,

On Tuesday 20 March 2012 17:02:51 Jozef Vesely wrote:
> Good day,
> 
> I am sorry to disturb you, I have been reading through uvc driver source
> and this caught my eye:
> http://lxr.linux.no/#linux+v3.3/drivers/media/video/uvc/uvc_v4l2.c#L671
> 
> 678: int pin = 0;
> ...
> 689: } else if (pin < selector->bNrInPins) {
> ...
> 690: pin = selector->baSourceID[index];
> 
> pin is always 0 in the comparison, was this intended?
> (wasn't the line 690 supposed to be before the comparison?
> or the index to be compared  to bNrInPins?)
> 
> Please excuse me wasting your tine if it is a total nonsense.

It's not a waste of time at all. Thank you for the report.

The following patch should fix the problem.

commit 578ac85ae011ed5d1f3aeebcb511509c84792f23
Author: Laurent Pinchart <laurent.pinchart@...asonboard.com>
Date:   Wed Mar 21 13:50:36 2012 +0100

    uvcvideo: Fix ENUMINPUT handling
    
    Properly validate the user-supplied index against the number of inputs.
    The code used the pin local variable instead of the index by mistake.
    
    Reported-by: Jozef Vesely <vesely@....sk>
    Signed-off-by: Laurent Pinchart <laurent.pinchart@...asonboard.com>
    Cc: stable@...r.kernel.org

diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
index 111bfff..a6b9491 100644
--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
@@ -687,7 +687,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
 					break;
 			}
 			pin = iterm->id;
-		} else if (pin < selector->bNrInPins) {
+		} else if (index < selector->bNrInPins) {
 			pin = selector->baSourceID[index];
 			list_for_each_entry(iterm, &chain->entities, chain) {
 				if (!UVC_ENTITY_IS_ITERM(iterm))

I will push it to mainline.

> PS: I am looking for a reason why MJPEG stopped working on my cameras (long
>> time ago), any hints?

Not as such. Could you please provide me with more information ? You can drop
the linux-kernel CC and add linux-uvc-devel@...ts.sourceforge.net
(subscriber-only at the moment) or linux-media@...r.kernel.org instead.

-- 
Regards,

Laurent Pinchart

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/