linux-kernel - [PATCH] media: v4l2-compat-ioctl32: check for max size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1603108489-4832-1-git-send-email-bodefang@126.com>
Date:   Mon, 19 Oct 2020 19:54:49 +0800
From:   Defang Bo <bodefang@....com>
To:     mchehab@...nel.org, hverkuil-cisco@...all.nl
Cc:     linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        Defang Bo <bodefang@....com>
Subject: [PATCH] media: v4l2-compat-ioctl32: check for max size

Similar to commit<ea72fbf588ac>("media: v4l2-compat-ioctl32: prevent go past max size"} ,add max size check for count variable.

Signed-off-by: Defang Bo <bodefang@....com>
---
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index a99e82e..5041d60 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -207,7 +207,7 @@ static int put_v4l2_window32(struct v4l2_window __user *p64,
 	    get_user(clipcount, &p64->clipcount) ||
 	    put_user(clipcount, &p32->clipcount))
 		return -EFAULT;
-	if (!clipcount)
+	if (!clipcount || count > (U32_MAX/sizeof(*uclips)))
 		return 0;
 
 	if (get_user(kclips, &p64->clips))
-- 
1.9.1