linux-kernel - [PATCH] media: dvb-frontends: dib7090: fix null-ptr-deref in dib7090_tuner

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250607173731.2363567-1-alexguo1023@gmail.com>
Date: Sat,  7 Jun 2025 13:37:31 -0400
From: Alex Guo <alexguo1023@...il.com>
To: mchehab@...nel.org
Cc: hverkuil@...all.nl,
	algonell@...il.com,
	linux-media@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Alex Guo <alexguo1023@...il.com>
Subject: [PATCH] media: dvb-frontends: dib7090: fix null-ptr-deref in dib7090_tuner_xfer()

In dib7090_tuner_xfer, msg is controlled by user. When msg[0].buf is null
and msg[0].len is zero, former checks on msg[0].buf would be passed. If 
accessing msg[0].buf[0] without sanity check, null pointer deref would 
happen. We add check on msg[0].len to prevent crash. Similar issue occurs
when access msg[1].buf[0] and msg[1].buf[1].

Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

Signed-off-by: Alex Guo <alexguo1023@...il.com>
---
 drivers/media/dvb-frontends/dib7000p.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
index b40daf242046..46753d2ae212 100644
--- a/drivers/media/dvb-frontends/dib7000p.c
+++ b/drivers/media/dvb-frontends/dib7000p.c
@@ -2270,6 +2270,8 @@ static int dib7090_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msg[]
 {
 	struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
 
+	if (msg[0].len < 1)
+		return -EOPNOTSUPP;
 	u16 apb_address = 0, word;
 	int i = 0;
 	switch (msg[0].buf[0]) {
@@ -2360,11 +2362,15 @@ static int dib7090_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msg[]
 	case 0x1d:
 		i = ((dib7000p_read_word(state, 72) >> 12) & 0x3);
 		word = dib7000p_read_word(state, 384 + i);
+		if (msg[1].len < 2)
+			return -EOPNOTSUPP;
 		msg[1].buf[0] = (word >> 8) & 0xff;
 		msg[1].buf[1] = (word) & 0xff;
 		return num;
 	case 0x1f:
 		if (num == 1) {	/* write */
+			if (msg[0].len < 3)
+				return -EOPNOTSUPP;
 			word = (u16) ((msg[0].buf[1] << 8) | msg[0].buf[2]);
 			word &= 0x3;
 			word = (dib7000p_read_word(state, 72) & ~(3 << 12)) | (word << 12);
-- 
2.34.1