linux-kernel - [PATCH] [media] atomisp2: array underflow in ap1302_enum_frame

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20170719095618.g36egw4t4t5h4tzh@mwanda>
Date:   Wed, 19 Jul 2017 12:56:18 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Mauro Carvalho Chehab <mchehab@...nel.org>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Alan Cox <alan@...ux.intel.com>, linux-media@...r.kernel.org,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org
Subject: [PATCH] [media] atomisp2: array underflow in ap1302_enum_frame_size()

The problem is this code from ap1302_enum_frame_size():

   738          int index = fse->index;
   739  
   740          mutex_lock(&dev->input_lock);
   741          context = ap1302_get_context(sd);
   742          if (index >= dev->cntx_res[context].res_num) {
   743                  mutex_unlock(&dev->input_lock);
   744                  return -EINVAL;
   745          }
   746  
   747          res_table = dev->cntx_res[context].res_table;
   748          fse->min_width = res_table[index].width;

"fse->index" is a u32 that come from the user.  We want negative values
of "index" to be treated as -EINVAL but they're not so we can read from
before the start of the res_table[] array.

I've fixed this by making "res_num" a u32.  I made "cur_res" a u32 as
well, just for consistency.

Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>

diff --git a/drivers/staging/media/atomisp/i2c/ap1302.h b/drivers/staging/media/atomisp/i2c/ap1302.h
index 9341232c580d..4d0b181a9671 100644
--- a/drivers/staging/media/atomisp/i2c/ap1302.h
+++ b/drivers/staging/media/atomisp/i2c/ap1302.h
@@ -158,8 +158,8 @@ struct ap1302_res_struct {
 };
 
 struct ap1302_context_res {
-	s32 res_num;
-	s32 cur_res;
+	u32 res_num;
+	u32 cur_res;
 	struct ap1302_res_struct *res_table;
 };